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II. General Conditions of Contract 

1. General Provisions 


Unless the context otherwise requires, the following terms whenever 

used in this Contract have the following meanings: 

(a) Applicable Law’ means the laws and any other instruments 
having the force of law in the Government's country, or in such 
other country as may be specified in the Special Conditions of 
Contract (SC), as they may be issued and in force from time to 

(b) “Consultant” means any private Or public entity that will provide 
the Services to the Employer under the Contract. 

(c) “Contract” means the Contract signed by the Parties and all the 
attached documents listed in its Clause 1, that is these General 
Conditions (GC), the Sjxrcial Conditions (SC), and the 
Appendices. 


(e) “Effective Date” means the date on which this Contract comes into 
force and effect pursuant to Clause GC 2.1: 


“GC” means these General Conditions of Contract. 

“Government” means the Government of the Employer’s country. 
“Local Currency” means the currency of foe Employer’s country. 


) “Personnel” means persons hired by foe Consultant or by any Sub- 
Consultants and assigned to the performance of the Services or any 
part thereof. 


(o) Services” means the work to be performed by foe Consultant 
pursuant to this Contract, as described in Append - 



















r 

hereto. / 

(p) “Sub-Consultants" means any person or entity to wbom/which the 
Consultant subcontracts any part of the Services. 

(q) In writing” means communicated in written form with proof of 
receipt. 

(r) CIDR- means the complete U1D application software IT 
faciftti™ CtUre ’ ^ CCntCr ^ Wel1 aS 1116 disas,er recovery center 

(s) “IT Systems” means all application software, middleware, system 
software, database, servers, networidng, security, storage, etc. 

1.2 

Rdalionshi 

the Parties 

Nothing contained herein shall be construed as establishing a 
relationship of master and servant or of principal and agent as between 
the Employer and the Consultant. The Consultant, subject to this 
Contract, has complete charge of Personnel and Sub-Consultants if any 
performing the Services and shall be fully responsible for the Services 
performed by them or on their.behalf hereunder. 

13 Law 

Governing 

Contract 

Hus Contract, its meaning and interpretation, and the relation betv^n 
the Parties shall be governed by the Applicable Laws oflndia. 

1.4 Language 

This Contract has been executed in English, which shall be the binding 
and controlling language for all matters relating to the meanin» or 
interpretation of this Contract c 

1.5 Notices 


13.1 

Any notice, request or consent required or permitted to be given oTmldc 
pursuant to this Contract shall be in writing. Any such notice request or 
consent shall be deemed to have been given or made when delivered in 
person to an authorized representative of the Party to whom the 

sp°“mthe n sc addreSSe<i ' ° f Wh6n SCnt to SUCh ^ 3t thc address 

13.2 

A Party may change its address for notice hereunder by giving the other 
Party notice in writing of such change to the address specified in the SC. 

1-6 Location , 

rhe Services shall be perlbrmed at such locations as are specified in 
Appendix A hereto and, where the location of a particular task is not so 
ipectfied, at such locations, as the Employer may approve. 

I 

[^Authority t 
J^fLead S 

n case the Consultant consists of a consortium of more than one entity 
he Members hereby authorize the entity specified (Lead Partner) in the 
-C to act on then behalf> exercising all the Consultant’s rights and 
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Representa 


obligations towards the Employer under this Contract, including 
without limitation the receiving of instructions and payments from the 
Employer. However, each member or constituent of Consortium of 


Any action required or permitted to fee taken, and any document required 
or permitted to be executed under this Contract by the Employer or the 
Consultant may be taken or executed by the officials specified in the SC. 


.10 Fraud and 
Corruption 


The Consultant, Sub-Consultants, and their Personnel shall pay such 
indirect taxes, duties, fees, and other impositions levied undi 
Applicable Laws of India 


“ ■=• the Employer’s policy to require that the Employer as well as 
Consultants observe the highest standard of ethics during the selection 
and execution of such contracts. In pursuance of this policy, the 
Employer: 

(a) defines, for the purpose of this provision, the terms set forth below 

as follows: 

<i) “corrupt practice" means the offering, receiving, or soliciting, 
directly or indirectly, of any thing of value to influence die 
action of a public official in the selection process 
contract execution; 

(ii) “fraudulent practice” means a misrepresentation or om 
of facts in order to influence a selection process c 
execution of a contract; 

(iii) collusive practices” means a scheme or arrangement between 
two or more consultants, with or without the knowledge of the 
Employer, designed to establish prices at artificial, 
noncompetitive levels; 

<iv) “coercive practices” means harming or threatening to hatm, 
directly or indirectly, persons or their property to infl,^ 
their participation in a procurement process, or affect the 
execution of a contract; 


(a) The Employer may terminate the contract if it determines at any time 
that representatives of the consultant were engaged in corrupt, 
fraudulent, collusive or coercive practices during the selection 
process or the execution of that contract, without the consultant 
having taken timely and appropriate action 



























Employer to remedy toe situation; 

(b) The Employer may also sanction against the Consultant, including 
declaring the Consultant ineligible, either indefinitely or for a stated 
period ot time, to be awarded a contract if it at any time determines 
that the Consultant has, directly or through an agent engaged in 
corrupt fraudulent collusive or coercive practices in competing for. 
or in executing, a Employer-financed contract 

1.10.3 

Commissions 

and Foes 

o) Employer will require the successful Consultant to disclose any 

commissions or fees that may have been paid or are to be paid to 
agents, representatives, or commission agents with respect to the 
selection process or execution of the contract. The information 
disclosed must include at least the name and address of the agent, 
representative, or commission agent, the amount and currency’ 

and the purpose of the commission or fee. 


Commencement, Completion, Modification and 
Termination of Contract 


2.1 Effectiveness 

of Contract 

This Contract shall come into effect on the date the Contract is signed 
by both Parties or such other later date as may be stated in the SC 
Thedate the Contract comes into effect is defined as the Effective 

2.2 Termination 

of Contract for 

Failure to 

Become 

Effective 

If this Contract has not become effective within such time period 
after the date of the Contract signed by the Parties as specified in the 
SC, either Party may, by not less than twenty one (21) davs written 
notice to the other Party, declare this Contract to be null and void, 
and in the event of such a declaration by either Party, neither Party 
shall have any claim against the other Party with respect hereto. 

23 Commence¬ 
ment of 

Services 

the Consultant shall begin carrying out the Services not later than 
the number of days after the Effective Date specified in the SC. 

2.4 Expiration of 

Contract 

Unless terminated earlier pursuant to Clause GC 2.3 hereof this 
Contract shall expire at the end of such time period after the 
Effective Date as specified in the SC. 

2.5 Entire 

Agreement 

This Contract contains all covenants, stipulations and provisions 
agreed by the Parties. No agent or representative of either Party has 
authority to make, and the Parties shall not be bound by or be liable 
lor, any other statement, representation, promise or agreement not set 
forth herein. 





































2.6 Modifications 




a) Any modification or variation of the terms and conditions of this 

Contract, including any modification or variation of the scope of the 
Services, may only be made fcy written agreement between the 
Parties. However, each Party shall give due consideration to any 
proposals for modification or variation made by the other Partv. 

(b) In cases of substantial modifications or variations, the prior 
written consent of the Employer is required. 


2.7 Force Majeur 


a) For the purposes of this Contract, “Force Majeure” means an 

event which is beyond the reasonable control of a Party, is not 
foreseeable, is unavoidable and not brought about by or at the 
instance of the Party claiming to be affected by such events and 
which has caused the non-performance or delay in performance, and 
which makes a Party’s performance of its obligations hereunder 
impossible or so impractical as reasonably to be considered 
impossible in the circumstances, and includes, but is not limited to. 
war. riots, civil disorder, earthquake, fire; explosion, storm, flood or 
other extreme adverse weather conditions, strikes, lockouts or other 
industrial action (except where such strikes, lockouts or other 
industrial action are within the power of the Parly invoking Force 
Majeure to prevent), confiscation or any other action by Government 
agencies. 


(b) Force Majeure shall not include (i) any event which is caused by 
the negligence or intentional action of a Party or by or of such 
Party’s Sub-Consultants or agents or employees, nor (ii) any event 
which a diligent Party could reasonably have been expected both to 
take into account at the time of the conclusion of this Contract, and 
avoid or overcome in the carrying out of its obligations hereunder. 


2.7.2 No 
of Contract 


2.7.3 Measu 
be Taken 


(c) Force Majeure shall not include insufficiency of funds or 
inability to make any payment required hereunder. 

The failure of a Party to fulfil] any of its obligations under the 

contract shall not be considered to be a breach of, or default under, 
this Contract insofar as such inability arises from an event of Force 
Majeure, provided that the Party affected by such an event (a) has 
taken all reasonable precautions, due care and reasonable alternative 
measures in order to carry out the terms and conditions of this 
Contract, and (b) has informed the other Party as soon as possible 
about the occurrence of such an event. 

(a) A Party affected by an event of Force Majeure shall continue to 

perform its obligations under the Contract as far as is reasonably 
practical, and shall take all reasonable measures to minimise the 
consequences of any event of Force Majeure. 


±2 


(b) A Party affected by an event of Force Majeure shal l not ify the 
other Party of such event as soon as possible;- and^t? 
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later man tourteen (14) days following the occurrence of such event, 
providing evidence of the nature and cause of such event and shall 
similarly give written notice of the restoration of normal conditions 
as soon as possible. 

(e) Any period within which a Party shall, pursuant to this Contract 
complete any action or task, shall be extended for a period equal to 
the time during which such Party was unable to perform such action 
as a result of Force Majeure. 

(d) During the period of their inability to perform the Services as a 
result of an event of Force Majeure, the Consultant, upon instructions 
by the “Employer”, shall either: 


(i) Demobilize,; or 


(ii) Continue with the Services to the extent possible, in which case 
the Consultant shall continue to be paid proportionately and on 
prorata basis, under the terms of this Contract. 

(e) In the case of disagreement between the Parlies as to the existence 
ot extent of Force Majeure, the matter shall be settled according to 
Clause GC 8. 

2.8 Suspension 

fhe “Employer” may, by written notice of suspension to the 
Consultant, suspend all payments to the Consultant hereunder if the 
Consultant fails to perform any of its obligations under this Contract, 
including the carrying out of the Services, provided that such notice 
of suspension (i) shall specify the nature of the failure, and (ii) shall 
allow the Consultant to remedy such Mure, if capable of being 
remedied, within a period not exceeding thirty (30) days after receipt 
by the Consultant of such notice of suspension. 

2.9 Termination 


2.9.1 By the 

Employer 

Ihe Employer may tenninate this Contract in case of the occurrence' 

S1 j ecified in paragraphs (a > thr ° u sh 0) of this 

Clause'rC 2.y.l. In such an occurrence the Employer shall give a not 
foss than thirty (30) days’ written notice of termination to the 
Consultant, and sixty (60) days’ in the case of the event referred to in 

Ce). 

(a) If the Consultant does not remedy a failure in the performance 
ol their obligations under the Contract, within thirty (30) days 
after being notified or within any further period as the 
employer may have subsequently approved in writing. 

1 

W If the Consultant becomes (or, if the Consultant consists of 
more than one entity, if any of its Members becomes and which 
contract) 5 * 3 "'' ^ ° n providin g. Services under this 

((if wOT-ll 

* - - r ^ lvershi l > l- - 

























(c) If the Consultant, in the judgment of the Employer has engaged 
in corrupt or fraudulent practices in competing for or in 
executing the Contract. 

(d) If, as the result of Force Majeure, the Consultant are unable to 
perform a material portion of the Services for a period of not 
less than sixty (60) days. 

(e) If the Employer, in its sole discretion and for any reason 
whatsoever, decides to terminate this Contract 

(0 If the Consultant submits to the “Employer” a false statement 
which has a material effect on the rights, obligations or 
interests of the “Employer”. 

(g) If the Consultant places itself in position of conflict of interest 
- or fails to disclose promptly any conflict of interest to the 

Employer. 

(h) If the consultant fails to provide the quality services as envisaged 

under this Contract; The Consultancy Monitoring Committee 
(CMC) formulated to monitor the progress of the assignment 
may make judgment regarding the poor quality of services, the 
reasons for which shall be recorded in writing. The CMC may 
decide to give one chance to the consultant to improve the 
quality of the services. 

(i) If the Consultant fails to comply with any final decision 
reached as a result of arbitration proceedings pursuant to Clause 
GC 8 hereof. 

(j) Employer reserves the right to terminate the agreement with the 
selected consultant or reduce the project cost at any stage of the 
project if the personnel proposed to be deployed full-time on 
this engagement are not actually working on this assignment on 
a full-time basis as proposed by Consultant 

The Consultants may terminate this Contract, by not less than thirty 

(30) days’ written notice to the Employer, such notice to be given 

after the occurrence of any of the events specified in paragraphs (a) 

through (d) of this Clause GC 2.9.2: 

(a) If the Employer fails to pay any money due to the Consultant 
pursuant to this Contract and not subject to dispute pursuant to 
Clause GC 8 hereof within forty-five (45) days after receiving 
written notice from the Consultant that such payment is 
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less than sixty (60) days. 

(c) If the Employer fails to comply with any final decision reached 
as a result of arbitration pursuant to Clause CSC 8 hereof. 

(d) If the “Employer” is in material breach of its obligations 

pursuant to this Contract and has not remedied the same within 
forty-five (45) days (or such longer period as the Consultant 
may have subsequently approved in writing) following the 
receipt by the “Employer” of the Consultant’s notice specifying 
such breach. & 

2.9.3 Cessation of 

Rights and 

Obligations 

Upon termination of this Contract pursuant to Clauses GC 2.2 or GC 
2.9 hereof, or upon expiration of this Contract pursuant to Clause GC 
2.4 hereof, all rights and obligations of the Parties hereunder shall 
cease, except (i) such rights and obligations as may have accrued on 
the date of termination or expiration, (ii) the obligation of 
confidentiality set forth in Clause GC 3.3 hereof, (Hi) the 
Consultant s obligation to permit inspection, copying and auditing of 
their accounts and records set forth in Clause GC 3.6 hereof and tivl 
any right which a Party may have under the Law. 

2.9.4 Cessation of 

Services 

Upon termination of this Contract by-notice of either Party to the 
other pursuant to Clauses GC 2.9.1 or GC 2.9.2 hereof, the 
Consultant shall, immediately upon dispatch or receipt of such 
notree, take all necessary steps to bring the Services to a close in a 
prompt and orderly manner and shall make every reasonable effort to 
keep expenditures for this purpose to a minimum. With respect to 
documents prepared by the Consultant and equipment and materials 
furnished by the “Employer”, (he Consultant shall proceed as 
provided, respectively, by Clauses GC 3.9 or GC 3.10 hereof. 

2.9.5 Payment 

upon Termination 

Upon termination of this Contract pursuant to Clauses GC 2 9 1 or 

GC 29.2, the Employer shall make the following payments to the 

Consultant: 

(a) If the Contract is terminated pursuant to Clause 2.9.1 (d), (e), 
(g). fo) or 29.2, remuneration pursuant to Clause GC 6.3(h), (i) 
hereof for Services satisfactorily performed prior to the 
effective date of termination, and’ reimbursable expenditures 
pursuant to Clause GC 6.3(hXii) hereof for expenditures 
actually^ and reasonably incurred prior to the effective date of 

(b) If the agreement is term inated pursuant of Clause 29.1 (a) to 
(c) and (f) to (i), the consultant shall not be entitled to receive 
any agreed payments upon termination of the contract 
However, the “Employer” may consider to make payment for 
the part satisfactorily performed on the basis of Quantum 
Mermt as assessed by it, if such part is of economic utility to 
the Employer. Applicable Under such circumstances, upon 

-termination, the Employer may also imnose Iiniri,l»>«t 
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damages as per the provisions of Clause 9 of this agreement. 
The consultant will be required to pay any such liquidated 
damages to Employer within 30 days of termination date. 

2.9.6 Disputes 

about Events of 

Termination: 

If either Party disputes whether an event specified in paragraphs (a) 
through (g) of Clause GC 2.9.1 or in Clause GC 2.9.2 hereof has 
occurred, such Party may, within forty-five (30) days after receipt of 
notice of termination from the other Party, refer the matter to Clause 
GC 8 hereof, and this Contract shall not be terminated on account of 
such event except in accordance with the terms Of any resulting 
arbitral award. 

2.10 Extension of 

Contract 

Ihe contract shall be extended for a period as required by the 
Employer based on mutual agreement. The man-month rates used for 
the calculation of the ‘Total Cost of Services’ as given in Appendix 
D shall be effective for such extension. 


3. Obligations of the Consultant 


3.1 General 


3.1.1 Standard of 

Performance 

fhe Consultant shall perform the Services and cany out their obligations 
hereunder with all due diligence, efficiency and economy, in accordance 
With generally accepted professional standards and practices, and shall 
observe sound management practices, and employ appropriate 
technology and safe and effective equipment, machinery, materials and 
melhods. The Consultant shall always act, in respect of any matter 
relating to this Contract or to the Services, as faithfirl advisers to the 
Employer, and shall at all times support and safeguard the Employer's 
legitimate interests in any dealings with Sub-Consultants or third Parties. 

3.2 Conflict of 

Ihe Consultant shall hold the Employer’s interests paramount, without 
any consideration for future work, and strictly avoid conflict with other 
assignments or their own corporate interests. If during the period of this 
contract, a conflict of interest arises for any reasons, the Consultant shall 
promptly disclose the same to the Employer and seek its instructions. 

3.2.1 Consultants 

Not to Benefit 

from Commis¬ 
sions, Dis¬ 
counts, etc. 

a) Ihe payment of the Consultant pursuant to Clause GC 6 shall 

constitute the Consultant’s only payment in connection with this 
Contract or the Services, and the Consultant shall not accept for 
their own benefit any trade commission, discount, or similar 
payment in connection with activities pursuant to this Contract or 
to the Services or in the discharge of their obligations under the 
Contract, and the Consultant shall use their best efforts to ensure 
that the Personnel, any Sub-Consultants, and agents of either of 
them similarly shall not receive any such additional payment. 

(b) Furthermore, if the Consultant, as part of the Services, has the 
responsibility of advising the “Employer” on the progutcmenl of 
- goods, works or -services, the Consultant shall the 
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3.2.2 Consultant 
and Affiliates Not 
be Otherwise 
Interested 
Project 


3.2.3 Prohibition 
Conflicting 
Activities 


Employer's applicable r .^ 1 „, lcl „ 

limes exercise such responsibility in the best interest of the 
“Employer”. Any discounts or commissions obtained by the 
Consultant in the exercise of such procurement responsibility shall 
be for the account of the “Employer”. 


The Consultant agrees that, during the term of flits v-ontraa and alter its 
ination, the Consultant and any entity affiliated with the Consultant, 
ell as any Sub-Consultants and any entity affiliated with such Sub- 
Consultants, shall be disqualified from providing goods, works or 
services (other than consulting services) resulting from or directly related 
to the Consultant’s Services for the preparation or implementation of the 
project. 


3.3 Confidentiality 



The Consultant shall not engage, and shall c 

Sub-Consultants and their Personnel not to engage, either directly 
indirectly, m any business or professional activities which would 
ides assigned tp diem under f ' 


conflict w 


Except with the prior written"consent of the Employer, the Consultant and 
the Personnel shall not at any time communicate io my person or entity 
any confidential information acquired in the course of the Services nor 
shall the Consultant and the Personnel make public the reco mme ndations 
tormulated in the course of, or as a result of, the Services. 

The Consultant (a) shall take out and maintain, and shall cause any Suh- 
Consultants to take out and maintain, at their (or the Sub-Consultants' as 
the case may be) own cost but on terms and conditions approved by the 
Employer, insurance against the risks, and for the coverage, as shall be 
specified m the SC; and (b) at the Employer’s request, shall provide 
evidence to the Employer showing that such insurance has been taken 
out and maintained and that the current premiums have been paid. 

The Consultant (i) shall keep accurate and systematic accounts "and 
records in respect of the Services hereunder, in accordance with 
internationally accepted accounting principles and in such form and 
detail as will clearly identify all relevant time changes and costs, and the 
bases thereof, and (n) shall periodically permit the “Employer” or its 
designated representative and/or the Employer, and up to five years from 
expiration or termination of (his Contract, to inspect Ihe same and make 
copies thereof as well as to have them audited by auditors appointed by 
the Employer or the Employer, if so required by the “Employer” or the 
Employer as die case may be. 


v. riting 


The Consultant shall obtain the Employer’s prior approval i 
before taking aiiy of the following actions: 

(a) Any change or addition to the Personnel listed in Appendix C. 

(b) Subcontracts: the Consultant may subcontract work relating to the 
Services to an extent and with such experts and entities as -mav be 
appro ved in advance, by the -' Employer^ Netwithstandino 
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Prior 

approval, the Consultant shall always retain full responsibility for 

Approval 

the “Employer” to be incompetent or incapable or undesirable in 
discharging assigned duties, the “Employer” may request the 
Consultant to provide a replacement, with qualifications and 
experience acceptable to the “Employer”, or to resume the 
performance of the Services itself. 

3-7 Reporting 
Obligations 

(a) I he Consultant shall submit to the Employer the reports and 

documents specified in Appendix B hereto, in the form, in the 
numbers and within the time periods set forth in the said Appendix. 

(b) Final reports shall be delivered in CD ROM in addition to the hard 
copies specified in said Appendix. 

3.8 Documents 

Prepared by 

the Consultant 

to be the 

Property of 
the Employer 

(a) All plans, drawings, specifications, designs, reports, other 

documents and software submitted by the Consultant under this 
Contract shall become and remain the property of the Employer, 
and the Consultant shall, not later than upon termination* or 
expiration of this Contract, deliver all such documents to the 
Employer, together with a detailed inventory thereof. 

(b) The Consultant may retain a copy of such documents, but shall not 
use anywhere, without taking permission, in writing, from the 
Employer and the Employer reserves right to giant or deny any 
such request.. If license agreements are necessary or appropriate 
between the Consultant and third parties for purposes of 
development of any such computer programs, the Consultant shall 
obtain the “Empioyer”’s prior written approval to such agreements, 
and the “Employer” shall be entitled at its discretion to require 
recovering the expenses related to the development of the 
program(s) concerned. 

3.9 Equipment, 

Vehicles and 

Materials 

Furnished by 

the 

“Employer” 

Equipment, vehicles and materials made available to the Consultant by 

the “Employer” or purchased by the Consultant wholly or partly with 
funds provided by the “Employer”, shall be the property of the 
“‘Employer” and shall be marked accordingly. Upon termination or 
expiration of this Contract, the Consultant shall make available to the 
“Employer” an inventory of such equipment, vehicles and materials and 
shall dispose of such equipment and materials in accordance with the 
“Employer”^ instructions. While in possession of such equipment, 
vehicles and materials, the Consultant, unless otherwise instructed by the 
“Employer” in writing, shall insure them at the expense of the 
“Employer” in an amount equal to their full replacement value. 

3.10 Equipment 

and Materials 

Provided by 

the 

Equipment or materials brought into the Government's country by the 

Consultant and the Personnel and used either for the Project or personal 
use shall remain the property of the Consultant or the Personnel 
concerned, as applicable. 
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4. Consultants Personnel 


4.1 General 

Ihe Consultant shall employ and provide such qualified and 
experienced Personnel and Sub-Consultants as are required to carry out 
the Services. 

4.2 Description of 

Personnel 

(a) 1 he title, agreed job description, minimum qualification 

and estimated period of engagement in the carrying out of the 
Services of each of the Consultants Key Personnel are as per the 
consultant's proposal and are described in Appendix C. If any of 
the Key Personnel has already been approved by the 
"Employer", his/her name is listed as well. 


-(b) If required to comply with the provisions of Clause GC 
- 3.1.1 hereof, adjustments withrespect to the estimated 

periods of engagement of Key Personnel set forth in 
Appendix C may be made by the Consultant by written notice 
to the "Employer”, provided (i) that such adjustments shall not 
alter the originally estimated period of engagement of any 
individual by more than 10% or one week, whichever is larger, 
and (ii) that the aggregate of such adjustments shall not cause 
payments under this Contract to exceed the ceilings set forth in 
Clause GC 6.1(b) of this Contract Any other such adjustments 
shall only be made with the "Emptoyer"*s written approval. 


43 


(c) If additional work is required beyond the scope of the Services 
specified in Appendix A, the estimated periods of engagement 
of Key Personnel set forth in Appendix C may be increased 
by agreement in writing between the "Employer" and the 
Consultant. In case where payments under this Contract exceed 
the ceilings set forth in Clause GC 6.1(b) of this Contract, this 
will be explicitly mentioned in the agreement. 


Approval of 
Personnel 


The Key Personnel and Sub-Consultants listed by title as well as by 
name in Appendix C are hereby approved by the "Employer". In 
respect of other Personnel which the Consultant proposes to use in 
the carrying out of the Services, the Consultant shall submit to the 
"Employer" for review and approval a copy of their Curricula Vitae 
(CVs). If the "Employer" does not object in writing (stating the 
reasons for the objection) within twenty-one (21) days from the date 
of receipt of such CVs, such Personnel shall be deemed to have 
been approved by the "Employer". 



(a) Except as the Employer may otherwise agree, no changes shall be 
made in the Key Personnel. If for any reason beyond the 
reasonable control of the Consultant, such as retirement, death, 
medical incapacity, among others, it becomes necessary 
• replace-any of-the Key Personnel,-the Consultant slialtprovide 
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of Personnel 

a replacement a person of equivalent or better qualifications. 

(b) If the Employer finds that any of the Personnel have (i) 
committed serious misconduct or have been charged with having 
committed a criminal action, or (ii) have reasonable cause to be 
dissatisfied with the performance of any of the Personnel, then 
the Consultant shall, at the Employer’s written request specifying 
the grounds thereof, provide as a replacement a person with 
qualifications and experience acceptable to the Employer. 


(a) and (b) above, as well as any reimbursable expenditures 
(including expenditures due to the number of eligible 
dependents) the Consultants may wish to claim as a result of such 
replacement, shall be subject to the prior written approval by the 
"Employer". The rate of remuneration applicable to a 
replacement person will be the rate of remuneration paid to the 
replacement person. Also (i) the Consultant shall bear all 
additional travel and other costs arising out of or incidental to any 
removal and/or replacement, and (ii) the remuneration to be paid for 
any of the Personnel provided as a replacement shall not exceed ihe 
remuneration which would have been payable to the Personnel 

4.5 Resident 

If required by the SC, the Consultant shall ensure that at all times 

during the Consultant's performance of the Services a resident project 

Project 

manager, acceptable to the "Employer", shall take charge of the 

Manager 

performance of such Services. 


5. Obligations of the Employer 


Assistance and 
Exemptions 


(a) Provide the Consultant, Sub-Consultants and Personnel with 
work permits and such other documents as shall be necessary to 
enable the Consultant, Sub-Consultants or Personnel to perform the 

(b) Arrange for the Foreign Personnel to be provided promptly with all 
necessary entry and exit visas, residence permits, exchang 
and any other documents required for their stay in India. 

(c) Issue to officials, agents and representatives of the Government all 
such instructions as may be necessary or appropriate for the prompt 
and effective implementation of the Services. 

nsultant, Sub-Consultants and Person nel an y such 
- - ty be specified in the SC. 




















5.2 Change in the 
Applicable 

Law Related tc 

Taxes and 

Duties 

. ' he da ‘ e of this Contract, there is any change in the 

Applicable Laws of India with respect to taxes and duties, which are 
directly payable by the consultant for providing the services ie 
service tax or any such applicable tax from time to time which 
increases or decreases the cost incurred by the Consultant in performing 
the Services, then the remuneration and reimbursable expenses otherwise 
payable to the Consultant under this Contract shall be increased or 
decreased accordingly by agreement between the Parties hereto and 
corresponding adjustments shall be made to the ceiling amounts 
specified in Clause GC 6.1(b). 

5.3 Services, 

Facilities and 

Property of 

the 

"Employer" 

(a) Ibe ’Employer" shall make available to the Consultant and its' 
Personnel, for the purposes of the Services and free of any 
charge, the services, facilities and property described in Appendix 
fc at the tunes and in the maimer specified in said Appendix E. 

(b) In case that such services, facilities and property shall not be 
made available to the Consultant as and when specified in 
Appendix E, the Parties ShalLagree-on any time extension that it 
may be appropriate to gtant to the Consultant for the performance 
of the Services. 

5.4 Payment 

In consideration of the Services performed by Consultant under this 
Contract, the "Employer" shall make to the Consultant such 
3nd m SUCh ,nannCr ** 15 provided by Clause GC 6 of this 

5.5 Counterpart 

Personnel 

(a) If necessary, the "Employer" shall make available to the 
Consultant free of charge such professional and support counterpart 
personnel, to be nominated by the "Employer" with the 
Consultant s advice, if specified in Appendix E. 

(b) Professional and support counterpart personnel, excluding 

Employers liaison personnel, shall wotk under the exclusive 
direction of the Consultant If any member of the 

counterpart personnel fails to perform adequately any work 
assigned to such member by the Consultant that is consistent with 
the position occupied by such member, the Consultant may request 
the replacement of such member, and the "Employer" shall not 
unreasonably refuse to act upon such request. 


6. Payments to the Consultant 


6.1 Total Cost of 

Services 

(a) Ibe total cost ot the Services payable is set forth in 
Appendix D as per the consultant’s proposal to the Employer 
and as negotiated thereafter. 


(b) Except as may be otherwise agreed under Clause GC ‘2 6 
and subject to Clause GC 6.1(c); payments under this 
Con tract shall not exceed the amount specified in Appendix-D. 
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-2 Currency of 
Payment 


Notwithstanding Clause GC 6.1(b) hereof, if pursuant to any ol 
the Clauses GC 4.2 (c) or 5.2 hereof, the Parties shall agree 
that additional payments shall be made to the Consultant 
order to cover any necessary additional expenditures ta 
envisaged in the cost estimates referred to in Clause GC 6.1(a) 
above, the ceiling or ceilings, as the case may be, set forth ir 
Clause GC 6.1(b) above shall be increased by the amount ot 
amounts, as the case may be, of any such additional payments. 


AH payments shall be made in Indian Rupees.[In case the payment i 
to be made in the currency other that Indian Rupees, the sam 
shall be mentioned in stead of Indian Rupees] 


The payments in respect of the Services shall be made as follows: 

(a) The consultant shall submit the invoice for payment when the 

payment is due as per the agreed terms. The payment shall be 
released as per the work related milestones achieved and as per 
the specified percentage as per SC. 

(b) Once a milestone is completed, the consultant shall submit 
the requisite deliverables as specified in this Contract The 
Employer shall release the requisite payment upon accepta 
of the deliverables. However, if the Employer fails 

intimate acceptance of the deliverables or its objecti__ 

thereto, within 30 days of receipt of it, the Employer 
shall release 75% of the payment for the respective 
deliverable without further delay (maximum 30 days) and the 
consultant shall produce a Bank Guarantee for the same. Th< 
remaining 25% of the payment for the respective deliverable 
shall be paid on acceptance of the deliverable by the Employer. 
The Bank Guarantee shall be released when the Unique 
Identification Authority of India accepts the respective 
deliverable. - 

(c) Final Payment: The final payment as specified in SC shall be 
made only after the final report and a final statement, 
identified as such, shall have been submitted by the 
Consultant and approved as satisfactory by the "Employer''. 
The Services shall be deemed completed and finally accepted 
by the "Employer" and the final report and final statement shall 
be deemed approved by the "Employer" as satisfoctory ninety 
(90) calendar days after receipt of the final report and 
final statement by the "Employer" unless the "Employer", 
within such ninety (90) day period, gives written notice to 
the Consultant specifying in detail deficiencies in the Services, 
the final report or final statement. The Consultant shall 
thereupon promptly make any necessary corrections, and 
thereafter the foregoing process shall be repeated, 
amount, which the "Employer" has paid or caused to be 
in accordance with this Clause in excess 6f the, ' 
actually payable in accordance, with the pfovisir 





















Contact, shall be reimbursed by the Consultant to the 
"Employer" within thirty (30) days after receipt by the 
Consultant of notice thereof. Any such claim by the 
"Employer" for reimbursement must be made within twelve 
(12) calendar months after receipt by the "Employer" of a final 
report and a final statement approved by the "Employer” in 
accordance with the above. 

(d) For the purpose of payment under Clause 6.3 (b) above, 
acceptance means; acceptance of the deliverables bv the 
Employer after submission by the consultant and the consultant 
has made presentation to the CMC / Employer (Mention 
this if presentation is required) with / without 
modifications to be communicated in writing by the Employer 
to the consultant 

(e) If the deliverables submitted by the consultant are not acceptable 

to the Employer / CMC, reasons for such non-acceptance 
should be recorded in writing; the Employer shall not release 
the payment due to the consultant. This is without 
prejudicing the Employer's right to levy any liquidated 
damages under clause 9. In such case, the payment will 
be released to the consultant only after it re-submits the 
deliverable and which is accepted by the Employer. 

(f) All payments under this Contact shall be made to the accounts 
of the Consultant specified in the SC. 

(g) With the exception of die final payment under (c) above, 

payments dp not constitute acceptance of the Services nor 
relieve the Consultant of any obligations hereunder, unless 
the acceptance has been communicated by the Employer to the 
consultant in writing and the consultant has made necessary 
changes as per the comments / suggestions of the Employer 
communicated to the Consultant. 

(h) In case of early termination of the contract, the payment 
shall be made to the consultant as mentioned here with: 

(i) Assessment should be made about work done from the 
previous milestone, for which the payment is made or to be 
made till the date of the termination. The consultant shall 
provide the details of persons reasonably worked during 
this period with supporting documents. Based on such 
details, the remuneration shall be calculated based on the man 
month rate as specified, 

(ii) A reasonable assessment of the reimbursable and 
miscellaneous expenses shall be made based on details 
fumislied by the consultant in this regard with supporting 
documents and based on the assessment of the work done 

- the- respective rates ns -provided. Wherever such .an 
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assessment is difficult, the rates should be arrived at by] 
calculating the amount on pro-rata basis. The tola] amount 
payable shall be the amount calculated as per (i) and (ii) above 
plus any applicable tax. 

7. Good Faith 

7.1 Good Faith 

The Parties undertake to act in good faith with respect to each other’s 
rights under this Contract and to adopt all reasonable measures to ensure 

the realization of die objectives of this Contract. 

7.2 Operation of 

the Contract 

1 he Parties recognize that it is impractical in this Contract to provide for 
every contingency which may arise during the life of the Contract, and 
the Parties hereby agree that it is their intention that this Contract 
shall operate fairly as between them, and without detriment to the 
interest of either of them, and that, if during the term of this Contract 
enter Party believes that this Contract is operating unfairly, the Parties 
will use their best efforts to agree on such action as may be necessary to 
remove the cause or causes of such unfairness, but no failure to agree on 
any action pursuant to this Clause shall give rise to a dispute subject to 

arbitration insaccoidance with Clause GC 8 hereof. 


8. Settlement Of Disputes 


8.1 Amicable 

Settlement 

Performance of the contract is governed by the terms & conditions of 
the contract, m case of dispute arises between the parties regarding any 
matter under the contract, either Party of the contract may send a 
written Notice of Dispute to the otter party. The Party receiving the 
Notice of Dispute will consider the Notice and respond to it in writing 
within 30 days alter receipt. If that party fails to respond within 30 days, 
or the dispute cannot be amicably settled within 60 days following the 
response of that party, clause GC 8.2 shall become applicable. 


(a) In the case of dispute arising upon or in relation to or in connection 
with the contract between the Employer and the Consultant, which 
has not been settled amicably, any party can refer the dispute for 
Arbitration under (Indian) Arbitration and Conciliation Act 1996. 
Such disputes shall be referred to an Arbitral Tribunal consisting 
of 3 (three) arbitrators, one each to be appointed by the Employer 
and the Consultant, the third arbitrator shall be chosen by the two 
arbitrators so appointed by tbe parties and shall act as Presiding 
Arbitrator. In case of feilure of the two arbitrators, appointed by 
the parties to reach a consensus regarding the appointment of the 
third arbitrator within a period of 30 days from the date of 
appointment of the two arbitrators, the Presiding arbitrator shall be 
appointed by the Secretary of the Ministry of Home Affairs. The 
Arbitration and Conciliation Act, 1996 and ant^srtsjtetory 
Modification--or re-enactment thereof shall < 
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arbitrationproceedingir " --— 

(b) Arbitration proceedings shall be held in India at the place indicated 
in SC and the language Of the arbitration proceedings and that of 
all documents and communications between the parties shall be 


(c) The decision of the majority of arbitrators shall be final and binding 
upon both parties. The expenses of the arbitrators as determined 
by the arbitrators shall be shared equally by the Employer and the 
Consultant. However, the expenses incurred by each party in 
connection with the preparation, presentation shall be borne by 
Ihe party itself. All arbitration awards shall be in writing and shall 
state the reasons for the award. 


9. Liquidated Damages 


9.1 Liquidity 

Damages 

I rhe parties hereby agree that due to negligence of act of any party ifihe 
other pm-ly suffers losses, damages the quantification of which may 
be difficult, and hence the amount specified hereunder shall be 
construed as reasonable estimate pf the damagesand both the parties 
agree to pay such liquidated damages, as defined hereunder as per the 
provisions of this Contract 

Damages 

lhe amount of liquidated damages for a particular deliverable under this 

C ontract shall not exceed 1 % of the proportionate value of the portion 
of that deliverable which is deemed incomplete bv the Employer as 
specified in Appendix D. 

93 Liquidity 
Damages 

The liquidated damages shall be applicable under following' 
circumstances: * 

(a) If a particular deliverables is not submitted' as per schedule as 
specified in SC 13 on account of reasons solely attributable to the 
Consultant, the Consultant shall be liable to pay 5% of the total cost of 
that deliverable, for delay of each week beyond 30 days or part thereof. 

(b) If a particular deliverables is not acceptable to the Employer as 
mentioned in Clause 0.3 (f), and defects are not rectified to the 
satisfaction of the Employer within 30 days of the receipt of the notice 
the Consultant shall be liable for Liquidated Damages for an amount 
equal to 5% of total cost of that particular deliverable for everv week or 
part thereof for the delay. 


10. Miscellaneous Provisions 


- - -ained in this Contract shall be construed as 

establishing or creating between the Parities, a relationship of 
master and servant or principal and agent. 
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Any failure or delay on part of any Party to exercise right or 
power under this Contact shall not operate as waiver thereof. 


<iii) 

The Coatactor/Consultant shall notify the Employer/ the 
Government of India of any material change in their 
status, in particular, where such change would 
impact on performance of obligations under this Contract. 


(iv) 

Each member/constituent of the Contactor/Consultant, in 
case of a Consortium, shall be jointly and severally 
liable to and responsible for all obligations 
towards the Employer/Government lor performance 



of worics/services including that of its 

Associates/Sub Contactors under the Contract. 


<v) 

The Contractor/Consultant shall at all times indemnity 
and keep indemnified the Employer/Government of India 
against all claims/damages etc. for any infringement of any 



Intellectual Property Rights (IPR) while providing its services 
under the Project 


(vi> 

The Conlractor/Consultant shall at all times indemnify 
and kegi indemnified the Employer/Government of 



India against any claims in respect of any damages 
or compensation payable in consequences of any accident 
or injury sustained or suffered by its (the 
Contractor's/Consultant's) employees or agents or by any 
other third Party resulting from or by any action, 
omission or operation conducted by or on behalf of 
the Contractor/Consultant. 


(vii) 

The Contractor/ Consultant shall at all times 
indemnify and keep indemnified the 

Employer/Government of India against any and all 
claims by Employees, Workman, Contractors, sub¬ 
contractors, suppliers, agent(s), employed engaged or 
otherwise working for the Contractor, in respect of wages, 
salaries, remuneration, compensation or the like. 


(viii) 

All claims regarding indemnity shall survive the termination 
or expiry of the Contract. 









111. Special Conditions of Contract 
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2.4 

The time period shall be thirty six months or such other period as the parties 
may agree in writing. 

2.9.5(b) 

Pursuant to the clarification dated 04-Jan-2010 (Appendix A-Part BrSection 7 
Clarifications to queries related with standard contract: S. No 6) issued by 
the Employer, the clause GC 2.9.5(b) shall be substituted as under 

“If the agreement is terminated pursuant of Clause 2.9.1 (a) to (c), (f) and (i), 
the consultant shall not be entitled (o receive any agreed payments upon 
termination of the contract. However, the “Employer" may consider to make 
payment for the part satisfactorily perforated on the basis of Quantum Merit 
as assessed by it, if such part is of economic^ utility to the Employer. 
Applicable Under such circumstances, upon termination, the Employer may 
also impose liquidated damages as per the provisions of Clause 9 of this 
agreement The consultant will be required to pay any such liquidated 
damages to Employer within 30 days of termination date." 


Pursuant to the clarification dated 04-Jan-2010 (Appendix A-Part BrSection 7 
Clarifications to queries related with standard contract: S. No -15) issued by 
the Employer, if the insurance cover already possesses these insurances, 
specific insurance need not be taken. However, clear documentation with 
respect to these insurances need to-be given to the Employer In case the 
Employer deems than the insurance cover is not satisfactory, the consultant 
shall procure project specific insurance 

3.5 

i 

1 

1 

The risks and the coverage shall be as follows: 

(a) Third Party motor vehicle liability insurance in respect of motor 
vehicles operated in the Government's country- by the Consultant or its 
Personnel or any Sub-Consultants or their Personnel, with a minimum 
coverage as per Motor Vehicles Act 1988; 

(b) Third Party liability insurance, with a minimum coverage of the value of 
the contract 

(c) professional liability insurance, with a minimum coverage of the value 
of the contract 

(d) employer s liability and workers' compensation insurance in respect of 
the Personnel of the Consultant and of any Sub-Consultants, in 
accordance with the relevant provisions of the Applicable Law, as well 
as, with respect to such Personnel, any such life, health, accident, travel 
or other insurance as may be appropriate; and 

e ) insurance against loss of or damage to (i) equipment purchased in 

whole or in part with funds provided under this Contract, (ii) the Consultant’s 
rroperty used in the performance of the Services, and (iii) any documents 
prepared by the Consultant in (the performance of the Services-—^- . 

———-—r---—-- 
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Pursuant to the clarification dated 04-Jan-2010 (Appendix A-Part BrSection 7 
Clarifications to queries related with standard contract: S. No 18) issued by 
the Employer, any payments or refunds shall be in accordance with the 
financial norms laid down by die Employer 


The amount in local currency is INR 7,05,90,67 


The accounts are: 

For local currency: Indian Rupees (INR) 

Pursmmt to the clarification dated 04-Jan-2010 (Appendix A-Part B:Section 7 
Clarifications to queries related with standard contract: S. No 5) issued by the 
Employer, for the Consultancy assignment, payments are linked 
deliverables according to the following schedule: 

(i) Ten (10%) percent of the lump-sum amount quoted for consultancy 
assignment shall be paid upon acceptance of the following, deliverables 
byUIDAI: 

(a) ‘Programme Management Strategy, Components, Roadmap and 
Implementation Plan’ 

(ii) Ten (10%) percent of the lump-sum amount quoted for consultancy 
assignment shall be paid upon acceptance of the following deliverables 
byUIDAI: 

(a) ‘Strategy, Business Models, Business Cases, and Potential 
Revenue Streams for CIDR’ 

^ CIDR CmCntat ' 0n ^ tia,e8y and lm plementation Roadmap for the 

(m) Twenty (20%) percent of the lump-sum amount quoted for consultancy 
assignment shall be paid upon acceptance of the following deliverables 
by UIDAI: 

(a) ‘Overview of Functional and Technical Solution of the CIDR, as 
input to the DPR’ 

(b) ‘Functional and Technical Requirements Specifications for the 

- non-IT (physical) infrastructure of the CIDR ’ 

(c) ‘Functional and Technical Requirements Specifications for the IT 
systems of the CIDR’ 

(d) Detailed Project Report (DPR) for implementation of the CIDR’ 

(iv) Fifteen (15%) percent of the lump-sum amount quoted for consultancy 

tyUIDAF Sha ” ^ P ‘ Ud UP °" acceptance of following deliverables 
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(a) ‘Request for Proposals (RFPs)’: 

RFP 1: Selection of Data Center Construction Agency to 
design, construct, and commission the CIDR facilities 
(physical infrastructure) 

RFP 2: Procurement of interim co-location facilities for the 
CIDR 

RFP 3: Selection of Managed Service Provider (MSP) to 
implement, and manage the CIDR 

(v) Ten (10%) percent of the lump-sum amount quoted for consultancy 
assignment shall be paid upon acceptance of the following deliverables 
byUIDAI: 

(a) ‘Risk Management Strategy and Plan for the CIDR’ 

(b) ‘Information Security Plan and Policies for the CIDR’ 

(c) ‘Disaster Recovery Plan (DRP) arid Business Continuitv Plan for 
the CIDR’ 


-(vi) Ten (10%) percent of the lump-sum amount quoted for consultancy 
assignment shall be pain upon completion of Ihc ‘Rid Process 
Management for Selection of Managed Service Provider . The payment 
shall be made on selection of the Managed Service Provider. 

(vii) Fifteen (15%) percent of tbe lump-sum amount quoted for consultancy 
assignment shall be paid upon completion of the ‘Certification and Go- 
Live of the CIDR’. 

(viii)Ftve (5%) percent of the lump-sum amount quoted for consultancy 
assignment shall be paid upon acceptance of the ‘Terms of Reference 
for 3™ Party Audits’ by UIDAI 

(ix) Five (5%) percent of the lump-sum amount quoted for consultancy 
assignment shall be paid upon completion of '3 months of Post- 
implementation Project Management Services’ 

UIDAI shall make the above payments within 30 days for all the 
deliverables which have been satisfactorily delivered and accepted. 

Pursuant to the clarification dated 04-Jan-2010 (Appendix A-Part B:Seetion7 
Clarifications to queries related with standard contract S. No 20) issued by 
the Employer, it is clarified that the final report and final statement applies to 
each deliverable 


The Arbitration proceedings shall take place in New Delhi in India. 

Pursuant to the clarification dated 04-Jan-2010 (Appendix A-Part Bisection 7 
Clarifications to queries relate 
of liquidated damages for a (p 















delay in submission less than 50 days shall not exceed 1 % of the 
proportionate value of the portion of that deliverable (as specified in 
Appendix D) which is deemed incomplete by the Employer as on the 
icified date of submission of that deliverable’ 


Signed, Sealed and Delivered for & 
on behalf of M/s Ernst & Young 
Pvt. Ltd 

Name : CVaf\W wy.' l 



Designation 

Date 
Place : 



Signed, Sealed and Delivered for & 
on behalf of M/s Net magic 
Solutions Pvt. Ltd. 

Signed 


Signed, Sealed and Delivered for and 
on behalf of the President of India 
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IV. Appendices 


Appendix - A :: Part A 

DESCRIPTION OF SERVICES 


1. Introduction 


The inability to prove identity is one of die biggest barriers in India which prevents the poor 
from accessing benefits and subsidies provided by the Government Public as well as private 
sector agencies across the country typically require proof of identity before providing 
individuals with services. But till date, there exists no nationally accepted, unique and verified 
identity number that both residents and agencies can use with ease and confidence. 

The Govemmenrof India (Go!) has embarked upon an ambitious initiative to provide a 
Unique Identification (UID) to eveiy resident of India and has constituted the Unique 
Identification Authority of India (UIDAI) for this purpose. The timing of this initiative 
coincides with the increased focus of the Gol on social inclusion and development through 
massive investments in various social sector programs, and transformation in public services 
delivery through e-Govemance programs. The scale of the UID initiative is unprecedented 
and its implementation will involve active participation of Central, State, and Local 
Governments, as well as public and private sector agencies across the coontry. 

All existing identity databases in India are fraught with problems of fraud and duplicate/ghost 
beneficiaries. To prevent this from seeping into the UIDAI database, the Authority plans to 
enroll residents into its database after proper verification of their demographic and biometric 
information. This will ensure that the data collected is clean from the start of the program. 
Hence the UIDAI aims to achieve de-duplication and ensure that each resident in the country 
has a unique identification number. 


A project of the_ scale of the UID has not been attempted anywhere in the world where the 
biometric and oilier details of a billion plus people have been stored. To implement this 
ambitious initiative, the UIDAI has devised a partnership approach that leverages the existing 
infrastructure of Government and private agencies across India. The UIDAI will be the 
regulatory- authority managing a Central ID Data Repository (CIDR), which will issue UID 
■lumbers, update resident information, and authenticate the identity of residents as required. 

In addition, the Authority will partner with agencies such as Central and Slate Oovemmepf-Jq 
departments and private sector agencies who. will be ‘Registrars’ for the UIDAI. RegisMWv* 
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will process UID applications, and connect to the CIDR to deduplicate information regarding 
residents and receive UID numbers, rhese Registrars can either be enrollera, or will appoint 
agencies as enrollers, who will interface with people seeking UfD numbers. The Authority 
also plans to partner with service providers for providing authentication services. 

Pursuant to the clarification dated 04-Jan-2010 (Appendix A-Part B.-Secfion 6 Clarifications 
to queries related to the Terms of Reference and Scope of Woric),lt has been further clarified 
that scope of work for the Consu Itant would also include the following: 


i- Designing the programme management strategy, programme plan and implementation 
roadmap for UID project which shall include CIDR implementation as one of the critical" 
programme components; 

ii. Formulating the strategy, business models, and implementation roadmap for the Central ID 
Data Repository (CIDR) of the UID project. The CIDR is essentially a service provider to die 
U1DAI and Will provide services which include the processing of enrolment and 
authenticanon requests, based on the business model 
m. Formulating the requirements & specifications for the CIDR; preparing the required RFPs; 
managing the bid processes; selecting a Managed Service Provider (MSP); defining functional 
and technical requirements specification of the application software; and providing project 
management services for the implementation of the CIDR. The consultant's scope of weak 
does not include formulating processes and guidelines for the UID project 
The tern, “CIDR”, used henceforth in this contact, includes the complete UID 
application software, IT infrastructure, data center as well as the disaster recover 


2. Functions of the VIDA1 

The Unique Identification Authority of India (U1DA1) has been created as an attached office 
under Ae Planning Commission. Ira role is fo develop and implement foe necessary 
institutional, technical and legal infrastructure to issue unique identity number ,o Indian 
res,dents. The Authority will prescribe guidelines on the biometric technology, the various 
processes around enrolment, and KYR verification. The UIDA1 will also design and create 
the institutional microstructure to effectively implement the policy. 









The functioning of UiBAI and the activities to be performed by it would serve multiple 
objectives. The Authority shall have the responsibilities to lay down plans and policies to 
implement the U1D, shall own and operate the DID database, and be responsible for its 
updation and maintenance on an ongoing basis. The figure below describes die proposed 
functional areas involved in the scope of the work of the UIDA1. 



Figure: Functional Scope of the VIDAf 

Project Management: 

a. Conceive and monitor the progress of the implementation of the project 

b. Ensure that the target milestones are being-met by all partner entities in implementing 

the UIDAl’s objectives. * 

c. Implement and ensure the usage of standard project management processes, and tools 

d. Risk assessment and issue monitoring 

e. Enable the sharing of knowledge and best practices amongst project stakeholders 

f. Act as the single point of contact for information on UID to Government entities and 
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Enable on-boarding of individual Registrars (such as NREGA, RSBY, and PDS) into 
the UID system. 

Support Registrars and agencies in adopting the UID authentication process and help 
define the uifrastnicture and process changes needed for UID-rcadiness. This will 
ndude linking to the CIDR, connecting to the UID system, and adding UID fields to 


theii 


tee a financial inclusion platform can effectively use the UID services in order to 
ng about secure authentication for micropayments and delivery of financial 
Vices, there is a need to support several registrars (such as NREGA, LAY etc) who 
I! need to do direct pavi 



j. Develop guidelines for pricing of UIDATs authentication scrubs,, ^.c-k :„,.| lrlr 
-UJD verification, address vertfication, and biometric confinnation. 

k. Prepare guidelines for compliance by agencies registered with the UIDA1 in using the 

UID authentication services as well as in managing resident infonnation. 


l. Prepare standards to enable Registrars maintain unifomrity in collecting biographic 
and biometric infonnation and for collecting information for basic Know Your 
Resident (KYR). These standards will be finalized by the KYR and biometric 
committees the Authority constitutes. To make sure the poor are not excluded, 
guidelines will also need to be prescribed for applicants without documents. 

m. Devise suitable procedures for KYR that will ensure the enrollment and inclusion of 
the poor into the UID database without compromising data integrity. 

n. Develop procedures for applying for a UID number including application fern 
formats, types of supporting documents, timeframes for issuance of UID numbers. 

o. Develop pre-enrollment processes in order to get the form filling and verification 
processes completed earlier and locally, so that the biometric enrollment is done 
quickly at enrollment workstations. 

p. Develop foe processes by with new birfos being captured by the birth registration 
process is being integrated into foe UID project in order to issue UIDs to infants as 
well. Similar process for updating death occurrences needs to also be integrated into 
the UID database. 


Prescribe technology standards: 
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js processes around enrol 


'• Devise Ilonns and procedures for fingerprint capture and verification and for 
introduction of a robust biometric authentication process at every point of transaction. 
Prescribe data management and security protocols, internal control mechanisms and 
other technology safeguards to preserve and protect information. 

. Prescribe standards including biometric standards to be followed by Registrars and 
enrolling agencies for performing their functions and duties in connection with the 
work of the U1DAI. 

. Prescribe standard workstations for enrollment as well as standards for authentication 
devices. Develop a program of empanelment of vendors who can provide certified 
devices. 


Identification of multiple approaches to reach specific population segments, 
especially marginalized groups, such as urban poor, children, women, difieremly- 
abied people; and tribal groups. In addition to this, there is a need to reach out lo - 
other marginalized groups such as homeless people, individuals in shelter homes, 
remand homes, asylums, etc. 

. Since UID will be a lifetime number and might require updates through the life-cycle 
of an individual, appropriate policies and procedures have to be put in place for 
expiry and re-activation ot the UID, and updating the biographic and biometric 
information in the U1D databases. Children may have to update their biometric 
information every live years, while adults may have to update their information every 


X. Devise plans and procedures for carrying out periodic information and process audits 
of Registrars and agencies to ensure data quality and compliance of guidelines 
recommended by UIDAI. The information audit might focus on verification of 
information that comes in from Registrars against scanned and physical documents. It 
should also include the monitoring of the efficacy of the enrollment process to enroll 
all the DID aspiring residents in a smooth and effective manner. The process audit 
might be carried out at various enrollment sites and focus on the processes, software. 
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. Develop guidelines and polities for partnership with civil society groups and 
common,It networks for promotion of the U1D number, and information 
dissemination on UID enrollment especially for rural women, tribal folks, and other 


Legal framework for coi 


z. Draft contractual agreements to enable the Authority enter into contracts with 
Registrars for ensoring confidentiality of infomiation they collect and store. Also 
agreements may need to be entered into with some Registrars and Sendee Providers 
for the sole purpose of using the authentication services of the C1DR. 
aa. Prepare template for contractual agreements between registrars and their enrolling 
agenctes m order to conduct enrolmentsi tocompliance with the KYR and Biometric 

standards as defined by the UIDAI 

lib. Prepare the mechanism for dispute resolution in case of a dispute whether the 
duplicate identified by the UID system is because of fraud or technical error. Define 

the applicable penal actions in fraud cases. ~ 

ctr. t'rescrrbe-regnlations fbr the functioning of the CIDR.-Registrars.enrolling agencies, 
and other service providers. 

Knowledge Management: 

dd. Implement effective tools for knowledge management to capture learning fiom 
successes and failures during fhe course of the project implementation This 
repost of knowledge can serve as a viral input to re-design or re-frame processes, 
standards, and policies as the project gets rolled-out across the country. 

In order to achieve the above the objectives, a Project Management Unit (PMU) has been 
established to provide technical and managerial support to the UIDA1 in the implementation 
of tire UID project. The consultant selected through this RFP is expected to work u, close 
coordination with the PMU. 

re derails on the UID project, refer to the project concept paper - “ Creating 

3T, available on the website 


/ 
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A) I'lauiiing and formulating the overall Programme Management Strategy; identifying 
Components; preparing a Roadmap and Implementation Plan for the USD project 

B) Identifying and developing Strategy, Business Models, and Business Cases for 
potential revenue streams from the CIDR 


C) Conceiving and formulating the Implementation Strategy and Roadmap for the CIDR 


D) Formulating the detailed Functional and Technical Requirements Specifications for 
all the IT and non-IT (physical infrastructure) components of the CIDR 

E) Preparation of Detailed Project Report (DPR) for implementation of the CIDR 

F) Preparation of Request for Proposals (RFPs}: 

1. RFP I: Selection of Data Center Construction Agency to design, construct, and 
commission the CIDR facilities (physical infrastructure) 

2. RFP 2: Procurement of interim Co-location facilities for the CIDR 

? 3 . RFP 3; Selection of Managed Service Provider (MSP) to implement, manage, and 

maintain the CIDR 

Gj Bid Process Management for the RFPs 

H) Formulating (he Risk Management Strategy and Plan for the CII)R 

I) Developing the Information Security Plan and Polieierfor the CIDR 

-1) Developing the Business Continuity Plan and Disaster Recovery Plan for the CIDR 
K) Providing Project Management Services for the CIDR, including implementation and 
post-implementation monitoring, validation and certification of CIDR readiness to 


The deliverables of the consultancy have also been aligned with the above scope of work as 
articulated below. 

4. Detailed Scope of Work 

The detailed terms of reference for the scope of work items mentioned above, are as follows: 









the ill!) project 


--(>) ihe consultant shall come out with a programme management strategy and 
roadmap for implementation of the UID project that links the underlying 
objectives of the UID project to the technical solution 







<ii) Cc 


the service delivery infrastructure of the UID project to deliver the UID services 
to a myriad range of stakeholders. So while developing the programme plan, the 
consultant will have to spend time with the UIDA1 management and technology 
team, and. other stakeholders to understand (lie future directions of the UID 
initiative and align various project components accordingly. 

<ui) The programme plan should provide an integrated view of the major events, 
activities, deliverables, and dependencies within the individual projects that 
comprise the UID initiative, together with die planned completion dates, 
progress indicators and other information. The plan should also provide a 
connected-view to other initiatives (related or linked) in die UID ecosystem that 
may impact the direction or outcomes of the project. 


by the CIDR, based on a business model. 

i) The business model should include the various types of revenue streams arising 
out of delivery of the proposed services from CIDR. The business cases should 
enable the UIDA1 to objectively measure the expected revenues, expected costs, 
benefits, policy implications, and risks of the proposed business model. The 
Employer is currently in the process of identifying the demand generation 
aspects of the UID project. The consultant shad consult and interface with the 
stakeholders in this activity. The Employer will provide necessary support for 
'tion with stakeholder departments. 
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(iii) If the legal framework necessitates changes in the Strategy and Business Models, 
the consultant shall modify/ update the same in consultation with the Employer. 
The role of The Consultant is limited to business model for revenue streams 
arising out of delivery of services from the CIDR. The consultant shall provide 
the options, checklists, and approaches for strategic evaluation and validation for 
CIDR revenue modejs. The primaiy objective is to be self-sustainable. 


Deliverable D2: 


Strategy, Business Models, Business Cases, and Potential Revenue 



(i) I he CIDR will be a resource of paramount importance for the UIDAI and the 
Government at largerThe consultant should devise an implementation strategy 
for the CIDR keeping in mind that the growth and capacity demands will 
increase at a steady pace over time. 

(ii) The consultant should look at technology trends and roadmaps and devise a 
multi-pronged approach to enable the growth and diversity for the next 3-10 
yeans, in innovative, realistic and cost-effective ways. The approach should 


Providing sufficient scalability in the CIDR while optimis 
utilization through efficient processes and new technologies 
Ensuring resiliency through appropriate architectures and i 
of technologies such as virtualization and cloud computing 
Creation of a set of data centers for load balancing, networl 
in general optimal performance of the entire CIDR to delivet 


ncorporatiot 




n management of the CIDR facilit 


Adoption of emerging technologies relevant to the Cl 


(iii) The consultant shall study, e 
implementation models: f< 


alttaic and provide recommendations on various^ 
• building and running the CH3R.~ 
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implementation models should consider various aspects involved in building, 
owning, and operating the CH>R by the Managed Service Provider. The issues 
related to providing strategic control of the C1DR assets to the UIDA1 should 
also be considered while designing the appropriate implementation models. 

<iv) Given the national importance of the CIDR infrastructure and services, the 
- consultant needs to come Hip with strategies to ensure that there is no (or 
minimal) vendor lock-in as well as eliminate the reliance on technologies and 
components whose availability is dependant on trade policies or security 
clearances of other countries. 

(v) The implementation strategy- shall take into account aspects like TCO, capital 
outflows from the Government and the payment streams to the MSP linked to 
pre-detennined goals agai^t Service Level Agreements (SLAs), including 
Operational Level Agreements (QLAs).- 

(vi) The implementation strategy devisedTby the consultant will take into account 
the initial pitot implementation of the CIDR in an interim co-location facility 
and-the eventual-migration to the permanent fiilMIedgetf custom-built CIDR 
facilities. The implementation strategy shall also propose an overall approach 
for application lifecycle management, scalability-, testing, benchmarking and 
post-implementation monitoring mechanisms. 

(Vii) The consultant shall develop a site selection processes for the interim co¬ 
location facility and the custom-built CIDR facilities, considering all critical 
selection criteria. 

(viii) The consultant shall also develop a detailed project implementation roadmap 
describing the phases, activities and responsibilities in the project 
implementation and management of the CIDR. The project implementation 
roadmap shall include sensitivity analysis vis-a-vis time and cost overruns 
(ix> The consultant shall prepare a report which at the minimum shall provide 
to &e following key questions: 

How many data centos (DC. Disaster Recovery, Near-site) will be 
needed for the CIDR? 

' Wha * the key subcomponents of the CIDR Application software 
(biometrics, fraud detection etc)? 

^ What is the composition of the MSP from a technology components, 
fa**** provider, implementer,’ grid operalfstpqitjis of view?--- 

cA 
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re the estimated budgets, timelines, roadmap for iinplem 


■ What is the right procurement (bundling) and hnplcn 

■ What is the strategy for migration of the CIDR fi 
location facility to the custom-built CIDR facilities? 


■ What is the CIDR Go-Live strategy? 

■ What will be the CIDR acceptance strategy? 


Deliverable 03: . 

Implementation Strategy-and Implementation Roadmap for the CIDR, 



The primary goal of tile consultant in this activity is to formulate the detailed 
functional and technical requirements specifications for all the components of the 
CTDR, including the CIDR Application software, IT infrastructure and the non-IT 
(physical) infrastructure. These requirements specifications shall form the basis for 
preparation of the DPR for implementation of the CIDR, as well as the RFPs for Data 
Center Construction Agency and Managed Service Provider. 



specifications for the CIDR, the consultant shall prepare and document the 
overview of the CIDR functional and technical «©lution,which shall provide as 
an input to the Detailed Project Report (DPR). As part of the scope of work for 
providing the functional and technical requirements specifications for die IT 
infrastructure, the consultant is expected to provide details of the various 
integration requirements for the CIDR, which includes interface specifications 
and standards for interoperability with other systemsulso. 
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i - Description of Services 


(ti) UIDAI staff will be the primary stakeholder the consultant will have to meet It 
is expected that existing design requirement documents prepared by the PMU 
and other members of UIDAI around the key technologies will be provided to 
the consultant 


m The Consultant shall ensure that all the aspects related to information security, 
including user security policy/ manuals and handbooks, privacy policy, need to 
be designed as pari of the deliverable related to information security plan and 
policies for the CIDR. 

(tv) Obtaining regulatory approvals for the CIDR physical infrastructure is not 
within the scope of the consultant. However, the consultant shall have to advise 
and guide the UIDAI on the various regulatory approvals and permissions that 
may Ire needed for establishing the CIDR facilities 



(ii) The consultant should propose critical design considerations and best practices, 
and determine the optimal tier-level classification for Ifae CIDR facilities. The” 
Uptime Institute’s tier classification system should be adopted as an industry- 
aceepted standard for designing the requirements specifications of the CIDR 
and for defining the levels of fault tolerance. 
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■ Power source - power distribution, including UPS, backup diesel 
generation, power distribution units (PDUs), and intermediate 
distribution units 

■ Heating, ventilation, and air conditioning (HVAC) systems - these may 
include rooftop units and distributed units that provide localized air 
cooling; additional cooling and air handling between racks. The 
specifications should also focus on provisioning for and maintaining 
adequate cooling and air movement, given the intense heat gain of 
modern blade server and direct-access storage device equipments. 

■ Fire protection systems (as per local fire department regulations) - 
including detection and abatement systems that most likely will combine 
pre-action wet systems interconnected with dry systems for sensitive 
areas, such as disk storage areas. 

* Security systems - including local and centralized security systems 

■ Raised floor systems - depending upon the floor size 

■ Make recommendations on Green IT solutions for the Data Center 

(iv) The consultant should take into accourif the following while formulating the - 
specifications for the electrical system design, but not limited to: 

■ Assessment of overall power requirements (using rack unit as a measure) 

■ Provision for multiple feeds 

■ Provision of maintenance and emergency shutdown switches at all entry 

■ Grounding and bonding system that complies with applicable codes and 
regulations 

■ Determining if equipment requires single phase or three-phase power 

■ Provision of single reference grid to reduce high-frequency' impedance 

■ Use of higher-gauge wire for future expa nsion 

■ Use of PDUs to integrate circuit breakers and equipment connections 

■ Use of power conditioning equipment to integrate with the UPS 

■ Provision to maintain relative humidity levels to minimize electrostatic 
discharge 

(v) The specifications for architecture and space design should focus on the raised 
floor area, lifts, rack layout, workstations and support areas, such as conference 
and supply rooms, as well as shipping, receiving, and staging areas. 
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(Vi) The consultant should also assess the impact of new hardware technologies on 
the physical infrastructure while formulating die requirements specifications for 
the CIDR facilities. 

<yn) The consultant should do a comprehensive estimation of the CIDR facilities’ 
construction costs and associated life cycle costs. The estimate should also 
include cost elements related lo diesel power, UPS, electrical system design, 
different levels of data center reliability and fault tolerance. The consultant 
should evaluate the level of redundancy (tier level) and its associated cost 
versus the cost of downtime. Sensitivity analysis relating to time and cost 
overruns should also be incorporated. 

(VIII) The consultant should determine requirements for management of the CIDR 
and helpdesk facilities that best aligns with the requirements and priorities of 
the project. 

(ix) The consultant shall specily detailed functional and technical requirements for 
an Integrated Building Management System for the CIDR facilities. 

(x) The consultant shall develop specifications 

security. The specification should include for complete closed circuit television 
surveillance system; sensing devices and controlled access systems; including 
card key, in combination with a bioit 
monitoring and control system. 




biirties, service levels and performance levels for all the IT components, 
assess (he technical implications of die CIDR, the UIDAI is planning, to 
a Proof-of-Concept (PoCy Pilot solution. The learnings from the PoC/ 
'-fledged CIDR solution that wilt be 


shalL be dove-yiled info the -fuJI-fli 
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implemented by the Managed Service Provider (MSP). The consultant is required to 
interact and work closely with die PoC team, PMU, and other stakeholders of the 
UIDA1 while formulating the detailed functional and technical requirements 
specifications for the CIDR IT systems. UIDAI wiU provide results of the PoC and 
pilot that should be used in formulating requirements for MSP. The consultant is 
tequired to receive and understand the output of the i'oc/Pilot from concerned parties. 

expected to document learning from PoC/Pilot by analyzing 


The consultant is noi 
PoC and Pilot results. 

- (“Ji Thc consultant shall propose and make use of best practices, standards, and 
proven methodologies while formulating the requirements specifications of the 
IT system components for long-term efficiency, availability, and reliability of 
the CIDR. 

~ (iv) The biometric sub-Systran i<Tcentral to the CIDR for enrolling as well as 
- “"Aemicating reskfems. h is nkily'flrat a multi-modal biometric solution will 
be used to achieve a high level of assurance. The 1 :N de-duplication envisioned 
will be by far the most computing-intensive operation of the UID system. 
Innovative techniques of hashing, indexing, distributed processing, and in¬ 
memory databases using multiple-biometric-modes will need to be employed to 
get acceptable performance. The consultant should evaluate and propose thc 
latest technology trends in cloud computing, massive memory management, 
biometric matching algorithms, etc., in thc design of the IT systems. 

(v) The consultant shall build a 5 and 10 year growth model for the CIDR based 
on: demand assessment; availability, performance, & scalability requirements; 
future data-processmg needs (associated with biometric de-duplication, data 
search, etc); and likely technological evolution. Based on the above, the 
consultant shall develop a methodology for workload analysis and 

(vi) The consultant shall propose and use various technical parameters and 
cumulate the requirements specifications of the ff system 


rmponents. The parameters shoulc 
■ network load and latency; 

* server, database, storage, netv 

* requirements for network moi 

* expected processing load ar 


ike into account, factors such as 

-k. and bandwidth sizing; 
umgand control; 
distribution of (pad across th 


technology components (specifically, the backend servers and storage, 
that will need.to be architected for the high demands of the I 
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requests) 


Hie large peak loads from authentication 


<vii) The consultant shall work closely with the technology team of the UIDAI to 
develop a set of overarching architecture and design principles and 
requirements’ for the CIDR IT systems, and to select the relevant viewpoints 
for documenting the various architectures’ of the CIDR. The architecture 
viewpoints may include: application architecture, data architecture, network 
architecture, security architecture, and deployment architecture. 

(vin) The architecture should provide details of the various integration requirements 
for the CIDR. including: 

■ interface specifications and standards for interoperability of CIDR with 
-multiple users; 

■ upload and liatcli processing modes: . _ _ _ 

integration with mobile networks, point-of-sale (POSy point-of- 

‘ transaction (POT) devices, 

• integration of network, application, and biometric layers with the CIDR 
database; 

• integration of UID processes and the technology solution. 

• Integration with multiple netwoiks is a critical aspect of die CIDR 
system, since all UID enrolment and authentication services will be 
available online. UID services could work over secure WAN networks, 
the vanilla internet or over mobile SMS channels. It could also 
potentially work over existing netwoiks such as credit-card POS (point- 


The consultant shall take int. 
such networks while foi 
requirements of the CIDR 


• account the integration aspects of multiple 
mulating the functional and technical 


(ix) The requirements specifications should also provide details of all the other 
S0 are corn P onen l s required in the CIDR, such as: OS and system software, 
enterprise anti-virus software, auditing tools, DNS software, messaging 
software, back-up software (with encryption capabilities), network management 
and infrastructure software, and building management systems (BMS). 

(x) The consultant shall also specify functional and technical requirements for an 
..administration system that Will help administer the UIDAI’s operations, 
including: account setup - creation/ modification of Registrars, enrolling and 
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authenticating agency accounts; role based access control — assign rights over 
UID resources based on role; audit trailing — track every access to the U1D 
system and store audit logs in a secure environment: fraud detection - detect 
identity theft and cyber crimes using audit trails; reporting and analytics - 
visual decision support tools - GIS, charting etc. The UIDAl will employ a 
GIS internet-based visual reporting system to track enrolment trends and 
patterns across India, as the project is rolled out across various Registrars mid 
States. The GIS system will show all UID enrolments by State(s), as well as by 
Registrars). The system will also be able to drill down within Stales and into 
Districts. 

(xi) Based on the requirements of the various IT system components, the consultant 
shall prepare the Bill of Materials (BOM.) with specifications for all hardware, 
networking, and software components, biometric technologies, matching 
algorithms, etc., taking into account various technology aspects, cost 
effectiveness, reliability -of the products and availability from several 
manufacturers/ OEMs, and technology obsolescence and product shelf-life. The 
consultant shall provide specifications of genericextemal interface adaptors for 
connecting with external data bases and systems (e.g. PAN database of Income 
Tax Dept). The study of the specific external databases, as and when they shall 
be finalized, is not part of scope of work of this Contract. 
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Prc 


hi of Detailed Project (DPR) for i 




Based on the implementation strategy and the detailed functional and technical 
requirements specifications for the C1DR, the consultant shall prepare a Detailed 
Project Report (DPR) for implementation of the C1DR suggesting an implementation 
-roadmap, resource requirements, timelines and budgetary requirements. The DPR 
will be the basis for obtaining the requisite sanction of funds for undertaking the 
project implementation. Tlte DPR shall list out each project component, need and 
criticality for the sam< resource requirements and the cost of implementation of each - 

project component (detailed costing sheets will have to be prepared by the 
consultant). The DPR shall inter-alia contain the following: _ s 


Overview of C1DR 











• UID CIDR Consul! 


Appendix A: Part A -Description < 


Strategy and Objectives of CJDR 
Benefits and Outcomes 
Implementation & Business Models 
Proposed Services and Service Levels 
Overview of Functional Solution 
Overview of Technical Solution 

Financial Estimates, for the complete implementation of the CIDR, 
including: interim co-local ion facilities, data center migration, permanent 
CJDR facil ities, and implementation and management of the CIDR by the 
MSP: 

- Capital Expenditure Estimates (Capex) 

— Operational Expenditure Estunates^Opex) 

Assumptions and Risk Management Plan 

Detailed project schedule defining key phases, interdependencies, critical 
paths and key milestones, from design, procurement, supply, 
construction, installation, commissioning, and Go-Live of the CIDR - 


Deliverable D7: “ - / ^ ' ' /• 

Detailed Project Report (DPR) for implementation of the CIDR 

---I- F. 



( 1 ) Based on the implementation strategy, and detailed functional and technical 
requirements specifications for the IT and non-IT infrastructure for the CIDR, 
the consultant shall prepare the following Request for Proposal (RPP)s: 
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3. RFP 3: Selection of Managed Service Provider (MSP) to implement, and 
manage titeClDR. 

(ii) The UIDAI may decide to opt for bundling of the above-mentioned 3 RFPs as a 
single combined RFP (RFP i + RFP 2 + RFP 3) or as a combination of 2 RFPs, 
such as: (a) RFP J, and (b) RFP 2+ RFP 3. 

(iii) The consultant shall prepare the RFPs conforming to the Government of India 
guidelines on procurement of goods & services, including ICB procurement 
guidelines if necessary. 

(*>■) The consultant shall make detailed RFP presentations to the UIDAI as and when 
required 


-(v) The RFPs shall include inter-alia contain the following details: 

■ Description of the project background and context 

■ Purpose of the RFP: the scope of tire services requested and what is not 

■ Project objectives. The objectives should broadly address aspects related 
to availability, service let-els, efficiencies, security and resilience factors, 
flexibility, scalability and cost. 

■ List of key stakeholders along with roles and responsibilities 

■ Scope of work, roles and responsibilities of service provider. This section 
should itemize the specific services requested through the RFP. The 
indicative broad scope of work for each if the RFPs has been provided 
below. The consultant shall provide the detailed scope of work m the 
RFPs based on exact requirements of the project in consultation with 
UIDAI. 


Functional and technical requirements specifications 
Requirements for high availability & security 
Requirements for Strategic Control of the infrastructure assets 
Compliance to regulatory requirements 
Operational requirements 

Acceptance criteria & system and security audit requirements 
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- General terms and conditions for bidding including, cost of RFP. 
conflict of interest, modification and withdrawal of bids, etc 

- Payment terms 

Legal and contractual specifications- The contract agreement should be 
based on the General Conditions of Contract (GCC) and Special 
Conditions of Contract (SCC), as defined by Government of India 
procurement norms 

Service Level Agreement (SLA) based on service-level goals and 
objectives. The SLA should provide the following: 

- SLA terms and definitions 

- SLA calculation principles and metrics 

- Audit compliance - . _ 

- Service levels during peak hours and extended business hours 

- Service level enforcemenL penalties 

- Issue resolution time 


The consultant shall develop the scope of work to be included in “RFP | ; Selection of 

Data Center Construction Agency to design, construct, erect, and commission the 
CIDR facilities (physical infrastructure)”, which shall inter-alia contain die following: 
■ CIDR planning and design based on foe RFP requirements specifications 
Site preparation as per the civil, electrical, and mechanical systems 
requirements of the CIDR facilities; 

Construction, erection, commissioning, and testing of foe CIDR facilities 
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- Specifications for multiple active power and cooling paths, with backup 
generator capabilities 

Specifications for secure, reliable, and scalable hosting, bandwidth, network 
and application services, redundancy, and multiple ISP support 
T'^^IMsfor availability of co-location ftpilities 

Secured access control with 24 * 7 monitoring with high-speed, fault- 
tolerant, secure data communications 


The consultant shall develop detailed scope of work to be included in “RIP 3 : 
Selection of Managed Service Provider (MSP) to implement, and manage the CIDR”, 
which shall inler-alia contain the following, but not limited to: 

■ Design. Development and Implementation of the CIDR based on the 

lunctiona) and technical requirements ofthe CIDR rr systems 

Procurement, supply, installation, and commissioning of IT infrastructure 
components 

Migration of the IT infrastructure from the interim co-location facilities to the 
permanent CIDR facilities 

Implementation of information security management systems and 
infrastructure monitoring & management systems: 

■ Testing and benchmarking 

■ Documentation and training 

■ Operations support and maintenance 

Managed services for all operations and processes of the CIDR 

■ Application helpdesk, call centers and facilitation centers, and support 

" End-to-end logistics management ofUID numbers 

* Facilities management services for CIDR 

■ System and database administration 

* JT systems management of UIDA1 regional offices 







2) RFP 2: Prc 

3) ,.RFP3:Scl ( 


I oyeRFPsmuybe 
n of the UIDAI 


(i) The consultant shall undertake the following activities a 
management for all the RFPs: 

' SUPP °" W - release of the RFP tender advertisements 
newspapers 

Support the UIDAI in conducting Pre-Bid conferences (ifnecess ) 
Compile response to bid queries and olarificatilntTd^la 

presentations before the Evaluation Committee 
Design the RFP evaluation criteria 
Pre-qualification evaluation 

Evaluation of foe technical bids, txmduct briefings and present,, , 
the Evaluation Committee 
Evaluation of foe commercial bids 

Compile the evaluation reports am! recommend foe best bidder 
Support foe Evaluation Committee to be se, up by foe UIDAI 
Evaluation of Bdl of Materials (BOM) 

Support UIDAI in negotiations and closure 
Support foe UfDAf in contract Enaction wi fo fo. ^ bjdder 
i) Dte consultant shall submit comprehensive bid evaluation reports consist ■ , 

Pre-qualification evaluation, Technical evaluation, and Commerciai 







































(v) The consultant shall propose the plan to obtain compliance 
Act of the Government of India 


5 ISO 27001 and IT 


•e die security policy documents which will fc 


(vi) The consultant s 

complied with during the si 

CIDR facilities. As part of this activity, the consultant should also frame network 
policies including firewall, access control, etc. The scope of work in this activity 
includes providing the complete plan and design of the ISMS, based upon which 
the CIDR facilities can be assessed for compliance to ISO 27001 and IT Act 


Deliverable 1)11: 


0 Developing the Disast 

(BCP) for the CIDR 




© The consultant shah design the. Disaster Recover Plan (DRPj and B(lsiness 
Continuity Plan (BCP) for the CIDR, which includes among other things: dam 
ropl,catron suategies behvron the DC, DR, ncar-site: and DC-DR connectivity 
and failover procedures. 

(ii) The BCP and DRP should be based on .he following analysis: 

Identification of critical processes for business continuity and disaster 
reeoverv 


ty at backup/ recovery 


■ Formulation of RPO and RTO requirement* 

Identification of appropriate network connect 
locations to enable business continuity 

■ Recommendation of best practices and options for business continuity 

Identification of requirements for establishing the DR site 
Defining processes to update the data at DR site 

• Defining processes for business continuity preparodness and DR sit 


Defining the drill for switchover betws 


nd DR 
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' - Description of Services 


H r 

.oriding Project 

via...,;, .mat Si, Gee- to 

. the CIDR, including 

in 

ipkn, elation a, 

Id post-implementation mo 


(t! 

.lilication olt 11)1 

t readiness to Co-Live 

• -m- *,£;«■- 


(0 The consultant shall be responsible for the project management of the CIDR 
implementation till the commissioning and Go-Live of the fall-fledged CIDR 
facilities, and for a period of 3 months post-implementation and Go-Live of the 
CIDR. 

(ii) The consultant shall report directly and shall be accountable to the UIDAI and 
shall establish methods for coordination between the MSP and other 
implementation partners (such as CIDR facilities construction agency). The 
consultant shall provide guidance to the MSP in terms of the work to be 
completed at each phase. The consultant shall be responsible Tor approving any - 

(iii) The consultant shall be responsible for monitoring adherence to timelines and 
shall ensure timely-completion of work as per the Project Plan. The consultant 
shall assistUIDAI in overseeing the entire CIDR implementation. 

(iv) The consultant shall also undertake on behalf of UIDAI the User Acceptance 
Testing (VAT) of the application software, by preparing test cases, test database, 
imparting training to the UIDAI-designated testers, documenting ihe defects, and 
troubleshooting Its resolution with the MSP. The consultant shall guide the MSP 
in setting up the test environment (The test environment shall also form part of 
the Bill of Materials in the RFP for MSP) 

(v) The consultant shall be responsible for certifying the completion of 
implementation and readiness of CIDR to Go-Live. 

<vi) The Program Manager, Project Manager (IT Systems) and Project 
Manager (Data Center Infrastructure) shall be available for the complete 
duration of the project till the end of the engagement, and the other 
proposed consulting resources shall be available as and when needed during 
the project management of the CIDR implementation. The consultant shall 
also bring onboard the necessary resources for providing project 
management services as per the requirements of the project. The consultant 
shall propose the organization structure of the team proposed for providing 
Project Management Services including the proposed roles and number of 
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Appendix A : Pari A - Description of Services 


resources in Form Ted, - 7B and the detailed approach for the sanut shall 

also be elaborated in the Technical Approach and Methodology. 

(vii) The scope of work of the consultant, inter-alia. shall include the following: 

- Review and validation of detailed project plan., including plan for 
procurement, installation, and commissioning, and Go-Live, prepared by 
the MSP/ implementation partners, through use of industry-standard 
project management and monitoring tools 

■ Scrutiny and verification of the complete Bill of Materials provided by 
MSP/ implementation partners, and providing necessary 
recommendations/ assistance to UIDAI for sign-offs on the same 
Verification and monitoring of the procurement, installation, 
configuration, and commissioning activities of the MSP/ implementation 

partnererelatEd to the vanous hardware, system software, and networking 
components of the CIDR, and providing the necessary management 
reports to UIDAI on these activities 

■ Verify the software agreements and licenses, including software updates, 
and upgrades are procured as per the Bill ofMaterials 

Prepare Terms of Reference and engage an agency on behalf of UIDAI to 
undertake a comprehensive CIDR facilities assessment and site 
acceptance testing and to certify that the CIDR has been built as per the 
functional and technical requirements specifications in the RFP and Data 
Center industry standards. 

■ Reviewing the deliverables of MSP and recommending approvals on 
deliverables to UIDAI 

■ Design the parameters and methodology- for load and stress testing of 
application software and proposed IT infrastructure conforming to 
attributes such as throughput and response times, scalability, integration, 
and interoperability, in an industry-standard testing lab environment. The 
consultant would not be responsible for procuring testing tools, if 
required. 

■ Prepare methodology, framework, and procedures for measurement of 
SLA parameters and user satisfaction, and recommend industry-standard 
tools for SLA monitoring 

■ Ensure knowledge transfer and training to the UIDAI-designated officials 
on the SLA monitoring tools 
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auditors for undertaking system, networking, security audits, etc. The 
scope of work in this activity does not include preparation of the RFP for 
third-parly agency, but includes preparation of a detailed Terms of 
Reference for foe third-party agency. The U1DA1 may decide on foe 
modalities of engaging the third-party agency at an appropriate time. 
Verify and validate foe Standard Operating Procedures put in place by 
MSP 

Identify- detailed interfaces in consultation with foe UIDA1. High level 
description of interfaces is discussed in the ""Creating a unique identity 
for eveiy resident in India - Draft approach"". 
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i - Description of Services 



Request for Proposals (RFPs): 

1) RFP 1: Selection of Data Center Construction Agency 
to design, construct, and commission the CIDR 

feci lilies (physical infrastructure) 

2) RFP 2: Procurement of interim co-location facilities 

for the CIDR 

3) RFP 3: Selection of Managed Service Provider {MSP) 
to implement and manage the CIDR 


Risk Management Strategy and Plan for the CIDR 


Information Security Plan and Policies for the CIDR 


Disaster Recovery Plan (DRP) and Business Con 

Plan for the CIDR 


Bid Evaluation Reports, con: 

1) Pre-qualification evaln.it 

2) Technical evaluation 

3) Commercial evaluation 


Project Management Reports 
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Appendix A : Part B 

Pre-bid Clarifications dated 04-Jaii-2010 


[Enclosed] 
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Appendix A : Part C Description of Approach & Methodology 


Appendix A : PartC 


Description of Approach & Methodology 


Preamble 

mm 

"Recall the face of the poorest, and the weakest man whom you wav have seaiimdask ? . 

yourself if the step yon contemplate is going to.be of anv me to him. Will, he gainmyihiiig by. 
ill WM H restore him to a control ova lux own life and de.stmv! - Mahatma Gandhi 


Delivering services to-a community of billion individuals - each with unique needs - and helping each one achieve 
his or tier own potential is vital to helping the larger community called India achieve its potential. The Unique ID 
(“UID") initiative is a measure to help us achieve this end. 

-■ Creation of the Centra] ID DataRepository ("CIDR*') is one OTthe Critical success factors for-deliveringibe~ 
benefits of UniquelDHt has firbe built to last. It will be a key instrument to secure equality of opportunity to _ 
India's citizens. As a step under contemplation, it stands theiest of Condhiji's talisman antftrasthe potential to 
transform the lives of a billion people. This is our inspiration to participate in this initiative. 

Ernst & Young's business strategy is founded on engagement with our people, clients and communities to help 
them achieve their potential. As authors of this proposal, we Consider it our privilege to be able to present to the 
Unique ID Authority of India ("U1DAO some of our views on how the CIDR can be implemented successfully. We 
hope we have addressed those issues in this proposal which wiH be pertinent to a successful implementation and 
that these add value to the overall UID program. 

The UID Implementation Program and CIDR implementation 

“To secure to all Indian citizens equality of status and of opportunity 

This was one of the first resolutions that we as people of India took when we constituted ourselves as a 
democratic republic more than three score years ago. Since then the nation has rolled out large programs to 
fulfill this resolve. The fulfillment has, however, been partial despite efforts of a nature unseen elsewhere in the 
world. The lack of unique citizen identity has stalled these efforts to a great measure. The other reason has been 
our growing population for which no means have proved adequate enough. 

We are entering a new decade of the 21 s * century. The steps that we started taking to infuse technology into 
governance are now delivering results. Public confidence in technology as a harbinger of better if not good 
governance is increasing. The UID program is a culmination of this growing confidence in our ability to 
technology for better governance. 

In its current form, the Unique ID will be a random 12-digit number with the basis for establishing uniqueness of 
identity being biometrics. This ID shall be generated through a technology solution. We shall refer to this 
technology solution as the Central ID Data Repository ("CIDR”). 

By announcing the launch of the UID program we have made a bold statement. We have stated that we will 
provide a Unique Identity to oyerT.139,964,932 people and use that as a measure tc 
of opportunity. We have captured global attention and countries.around the world 
world - want us to show the way. In short, India needsTo successfully implement th 












6D C R h f^feihi^-|f U -T^ in9 th< L UI ° pr0gram has been around the technology solution, especially th 
“ SI 1 n eas,bllltv ;" e sha " dlscuss these aspects in detail in our approach. To begin with, however, it 

in As one Of the f V * r £ US e i ements of the U| D program and how the CIDR implementation projec 

it n f, ?-f. e - lve . rab es of our assifthhieft. we shall illustrate below first our methodology and 
approach with illustrations to studv of the mrv br, n Wn)ui. n -- y ’ 


illustrations to study of the UiD implementat 
The PESTLE framework 

I h !..!, Dp ™?. ram : haS .. n . umerous Perspectives and without a structured approach significant aspects may be 

like to propose, for a start, using the time-tested PESTLE (Political, 

mnrnnmooH -■*, * .... coverage of a|| key dimens j ons Q f 


missed out. Keeping this in vL 
Economic, Social, Technology, 
the UID program. ... 


»d Environment) in 


We shall then identify key ongoing initiatives of the UID program m 
each of the areas and align the CIDR implementation program to it. 

We illustrate below how this approach will assist us in analyzing the 
overall UID program and preparing the implementation strategy for 
the CIDR. 1 

Political dimensions of the UID program 
The UID program is a change initiative of unprecedented scale. 

Political support and alignment of the UID program with the 

political objectives would be vital for the successof the program; 

The Government of Indians keen on having the initial set of UID _ 

numbers getting rolled out duringthe calendar year 2011. Working 
backwards, this would imply that at a minimum the co located 
interim implementation of the CIDR should be complete. 

wouW mdude - PeCtS * “* dimension whi< * could •*«*»«l from an implementation planning perspective 
a- EsiLtjcalsuc pprt for the leoisiative framework to he created 

required to give the UID a valid legal existence. This may require 
series of existing legislations. In our democratic setup, this support w 
b - MtfeaiMv-in for the f unding required for CIDR- Till >; m1 , r 
would be difficult to estimate the extent of funding that woult 
lolitical views emerging on project viability 



of legislations wi 


the CIDR implementation plan. 
Acceptance of UID bv the state 

a targe extent by the political s 
concept and political support to 
vital to promote acceptance of tl 


workable solution is not worked out, 
be required for the CIDR. There is 
which could in turn have an impact < 


nj local self-governments : The enrollment of 
pport from state and local self-governments 
making the necessary legislative changes at 


Economic dimensions ol 
Acceptance by large S€ 


ID prograi 


- delivery institutions would be vital for the economic viability of rolling out a laroe 

coufd adoprthe^D^Uy^iTbVthe^e^om^bankin^ancffha' 1 lu 3 PPP model ' Some f the kev^ectorsTwhich 

essential that the CIDR is ready to acceot the'lotd creat^ ["tm S ®T eS sectors - Simultaneously. it is 
entail usage of UID. Examples could be; P Y ' °" S of cust0TOers and ‘he transactions which 

i- Changes to the Know Your Customer (“KYC") procedures 

1B1 and SEBI guidelines regarding UID enabled financial transactions 


the approach paper for UID published by Ul 









iii. Tax compliance related transactions [Direct Tax (New Direct Tax Code) indirect Taxes (Good 
and Services Tax>) 

iv. Changes to guidelines for issuance of Digital Signatures 

This will indirectly create temporary costs Tor these sectors in-terms of process and technology changes and roll 
gut of the UIDKnow-Your Resident CKYR") requirements. 

Social dimensions of the U!D program 7" - 

The social side of the UID program will require detailed analysis in itself. Some aspects that would need to be 
studied and aligned back with the CIDR rollout would be: 

*■ Plans for citizen communication or public awareness especially among difficult-to-reach communities 
*■ Initiatives for training and capacity building in Outreach agencies 

» Spreading awareness among Government officials about the role of UID in delivery of services 
A structured marketing program would need to be used to synchronize the UID rollout with readiness of the 
respective enrollment agencies and the CIDR. The benefits of UID would need to be communicated through mass 
media in various Ideal languages and through otherinnovative methods. Some-key messages that would need to 

bo delivered would be: - __ 

- a. What is UID? 

b. How can you use the UID? - - — . 

. 0- How will thejjlp benefit you? 
ds What can you do to receive a UID? 
a. What would you be asked for when you apply for UID? 

f. How to handle exceptional situations 

g. Who will help you obtain a UID? 


Technology dimensions of the UID program 

While we shall discuss this In detail CIDR related technology aspects in our approach paper, from a UID program 
perspective availability and maturity of certain technologies may have an impact. These include: 

► Technology maturity of enrollment agencies 
Technology maturity of user groups 

UID rollout is currently envisaged to be done through an extended ecosystem of agencies. These are the 
Registrars, Sub-registrars and Outreach agencies. Since enrollment will be driven electronically, it is essential 
that rollout to these agencies happens in line with overall rollout plan for UID. 


To a great degree, the effectiveness of UID will come only once the 
As examples we can consider the following: 

*■ R-SSdiness. oLenroilment^gendes: Considering the nev 
specified, all registrars and sub-registrars would need to pn 
these standards and implement business processes in line w 


user groups are technology enabled to use it. 

w data standards and biometric standards 
-epare their IT systems to capture data as per 
*ith the Know Your Resident guidelines. 


application for UID can be as a User ID for citizens/residents to (og into the State Portal to avail e- 
Governance services. These applications would need to be able to interface with the CIDR for UID 


Thus there is a two-way relationship between UID j 
be factored in while planning the implementation c 


Lit of these programs which would need to 


Legal dimensions of the UID program 

A large portfolio of legal changes would be needed to implement the UID program. Key among these with which 
the CIDR implementation would need to alien with would hp- 
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ating a legal fr. 


► Passage of appropriate legislations/regulations at the central and sta 
around the Unique ID. These would include: 

a. Guidelines for roll out of Know Your Resident procedures 

b. Guidelines for usage of UID in citizen service delivery. Following are some examples: 

j. Provisionsofjncome Tax Act 
. ii. Provisions of Value Added Tax Act 
Iii. Provisions of Passport Act 

c. Laws/Regulations protecting privacy of citizen data 

d. Revisions to the Know Your Customer provisions in financial services under the Anti 
Laundering Act 7 2002 — - 

e. Guidelines for processing of mobile phone subscriptions and other utility connections etc. 
The alignment of legal and regulatory changes with the CIDR rollout is critical as a legal enforcement of th 

te severe bottlenecks in service delivery. 




appropriately ensuring readiness of Cl 


Environmental dimensions of the UID program 

rb f U - D pro9r ? m win pla T an important role in reducing usage of paper in Government and private sector by : 
reducing requirements for producing copies of identity proof. This single step in itself can help positron the UID 
program as a Green initiative. The technology infrastructure for the CIDR is likely to be energy consuming 
However, innovative measures such as dynamic capacity management can help setup Green IT infrastructure for 
* i be used topromote usage of UID and made an integral part of the. 

Our approach to creating the Enterprise Architecture for CIDR 

We shall hinge our approach to this assignment on The Open Group Architecture Framework ("TOGAF ™") While 
>V be out ot c °ntext ^e, we have selected this framework for two distinct 


of TOGAF m, 

itages it offers: 

a. It provides a method to iti 


/e consultations ai 









Description of Approach & Methodology 


Taking a business perspective, the CIDR is a key service offering of the Unique ID Authority of India. The success 
of the Unique ID program is dependent on: 

a. The timely enablement of the C1DR 

b. The quality of services offered by the CIDR perennially and 

c. The adoptfenof CIDR services by various stakeholders to the greatest possible extent 

In essence, success of the UiD program will have significant dependence on the Speed. Reliability and 
Availability of CIDR on a perennial basis. We, therefore, define these as the three rnyst-have features of the 
CIDR. These three attributes can be defined in the context of CIDR as: 



Both the cases will imply that a legitimate request for services from a resident is wrongly denied. In 
consideration of the above, the CIDR should feature a high degree of reliability. From a resident's standpoint, 
reliability would also translate into how securely the data provided to CIDR is managed. 

Ayailabjlityi The CIDR will be used round-the-clock perennially 5 . The non-availability of CIDR services could have 
significant impact on the functioning of a iarfle pcosystem of people at partner age ncies and their software 
applic atio ns which will rely on the CIDR being available for providing services. Such availability will not be limited 
to the software systems but also to the support systems that will be setup as part of the CIDR .implementation. 

Speed: The CIDR would need to be tuned to operate at high speeds co nsistently to deliver the nature Of services 
it will be required to deliver. These Would include: 

b. Response to verification requests - human and software initiated 


Envisioning the CIDR - Users and Use Cases 

The CIDR will be at the centre of a "Federated Set of Databases'. The whole ecosystem of Partners envisaged by 
the UIDAI will comprise of two key user groups: 

a. HmDataPrqvidSrscThis will include the group of agencies who will Implement the Know Your Resident program. 
These would include Registrars. Sub-Registrars, Enrollment Agencies and Outreach Agencies. In addition it would 
also include the Introducers'. Each one of these stakeholders has a key role to play in ensuring Data Ouality of the 


: is. however, acknowledged that there could be variation in the loading of the CIDR infrastructure., 
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scription of Approach & Methodology 


b - The Data Users: Thk qrrni| 


(and individuals? 6 ) wi 


The other key users would be the UIDAI. the Managed Service Provider and variou' 
UID AI may appoint, keeping these in view shown below is a LeveTl-illustration of mi 
the CIDR, Consideri ng the ^ -*— . 


External User 

: • 

; " Register their users/systems with the UIDAI through l^g-dDR 

* lnter4ace the ' r software systems foi capture of resident ’details with the CtDR for 
submission of Resident details foi de duplication 

Submit cases for uipAI's review in response to grievances received from residents for 

* wrong/nor. allocation of IJIO “ ' 

* View status of resident enrollment requests submitted 

Ou|re|ch^pups- - j 

View status of resident enrollment requests submitted 

* Tl)es * agencies could have a software interface wmi CIDR for the citizen to view status 
of enrollment request (possibly hosted as a web service! 

^Customers of ODD ' 

Register for use of CIDR 

Will submit verification requests to the CIDR through a software solution 

‘ Receive the verification request from CIDR 

' i 

UIDAI/CtDR Staff?™ 

f Receive communication on being allotted a DID H 

* Receive communication on successful change of data 
j^Sg^gyes tor redr<? ssal by the Registrars or by jfie (ilDAI ' 

1 ^ fc I,, 1 .. 

* Registration of members of data providerand data user group 
' Manage exceptions 

* Accounting for CIDR revenues 

* Detect frauds in the systems with the help of automated tools 

CIDR Help.pesk. ^ . 

. * Menage exceptions that may arise as^part of logistics^ DID management 

Third party auditory ' 

* View audit trailsof system usage 

* Monitor system usage 

- 

Obtain MIS repbrts to help monitor progressot UIO.impio,nf.ntation dcross India'" 5 " 
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Common ID Data Repository Software 
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Challenges in implementation of the CIDR 

When the above use cases are studied in conjunction with the Service and Operational tevei requirements that 
would surround die CIDR, it is evident that there are many design, development and implementation challenges 


1HEST ,rFW cSr; - cr riJ$fc 
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Technology challenges and o 

solution approach 


The core technology challenges related to the CIDR 

SSSSSSSSSSSSESS: 

wm Cs map to ChaPter " e PreSent 0ur approach to ^dressing the above technology challenges of CIDR. This 
Design needs of biometric matching system 
Key design goals for the biometric matching system 

There are three primary goals in the design of CIDR's biometric matching system: 

* The number of incorrect matches must be minimBeB 

minimized^ * P " ntS ' nCOrreCtly f0und to 001 mafeh prints actually in the enrolled database must be 

oust match the input rate of the prints (as averaged over a 
erational requirements), so as to prevent backlogs from 


The throughput rate of these comparisons 
time scale appropriate for the system o 


esign goals, following would be the key challenges that will emerge, 
e scale biometric matching 


implemented. The objective herein isonly to demonstrate ournnrtmt ** f!! erent from what ma y 9 et 
solving it through illustrations. understanding of the problem and approach to 















■ Methodology 



Defining _acceBtahle error limitsjnjhe system: In short, the variations in physical conditions and data 
capture and representational errors lead to errors in the matching process. The errors are of two types: 
o False match or 
o. False non-match 
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Biometric Pesign Consideratjon: Quantifying these errors for the tv 
as establishing acceptable limits to the two types of errors for our ar 
m of the overall system. Establishing acceptable limits for errors w. 


Need to use manual verification: in some cases,_the_automated algorithms will not be able to handle 
certain matches. One might have to fall back to manual verification in such cases. Creation of 
nmToT™ meth ° d " *° effiClentl V c^y out such verification is also critical to the success of the overall 
,ma9eS that 15 CaptUred durin9 enrollment could be of immense benefit at this 


nnlhnnri" r f Use of fingerprints as the primary method of 

then at on .s logical due to ,ts accuracy, ease of use. and cost effectiveness. However, during the 
enrollment phase, one might decide to use additional modalities such as IRIS images to enhance the 
accuracy and speed to the de-duplication process. The selection of the right modalities for this phase is 
need be donc b0:,ed on studies on the effectiveness of these modalities on samples from 


> Noter These challenges i 
Report to a great extent 
‘during biometric 


r UiOAf Biometrics Standards Committee 
an enrollment perspective. However, the modalities tobe-adopted 
especially in remote areas, are likely to emerge further m-due - 


qomputat-onal cost of de-duplication: During the creation of UiD for a person, their biometric data is 
: i . C0mpa ;^ a T 9am5t other person in the database to estabiish the uniqueness of the 
Mode th C ? a , COmputational cosl wi " »• *iven by various business drivers which will 

include acceptable level of accuracy and various Operational and Service Level requirements of the 

° Prior^sHmatesjfigardinft.eo mBu t atio n a l .COStS Of biometric matchin g- h^h „„ rrHr n , 

-t is estimated that systems of 20.000,000 enrolled persons, with input rates of 20.000 per day' 

unde svVetTri 0 0Perate rr dESi9n " mitS ° f 5% false n ° n - matches and 0-1* false matches 
der system decision policies tuned during implementation. A processing rate of 500,000 
matches per second should be sufficient for one-day processing in a four-finger system 7 . 


The above are primarily the challenges that need to be ov 
independent of the design of the overall system. The over 
matching, and result handling, need to be considered as p 
in isolation. H 


rcome at the CIOR. However, they are not 
II system that includes data capture, represent; 
rts of a system to solve the above challenges, a 


sed at each stage of the system.. For the sake of 
ire limited to fingerprints (10-prints), IRIS, as well 


iiometrkLcapXuie^ device: The technology of capture, its specifications t 

S ouar'friT T 0 ? a " be Se ' eCted ° r deS ‘ 9ned baS6d on the primaf V r«iuir. 

nest quality of data for de-duplication and verification. However, the factors that w 



interface and the 
lent, to provide the 
Id typically oppose 


.ivtlian^BiometHc Systems-lssues and Feasibility" by James I. Waymar, Director- US. ^ 






/■ 



BseraseiiiaUoa 

considered here 

0 Size o! represents- 


are planned. identifying - ■ 

need of the communication 


The factors that nee 


e representation 
gorithms with representa 
D r independence, both a 


£ammuni£at ion 

communication mm ■ 

through the channel. 


t the capture side, as well as at the m 


. purposes of-discussions on 

. ortirmarh f.SD 06 






Design constdei 

- Perform an ce pa tametersforAFIS M parameters that govern the performance of Automat* Fingerprint 

- r„"™ •..>» - -« 

the database fingerprints into i , n ri nains based on exogenous "filtering ’ techniques, 

measure endogenous to fi( J r systems and identification of the customer’s 

including identification or tne Tinge 

B en error rate or probability that a search for a print in the database will be unsuccessful because 
the sample and template prints were non . matchjng prints win be incorrectly 

jH. Single comparison false match rate, or prooau 

matched _ ra(e or proba bility that two matching prints will be incorrectly 

iv. Single comparison false non-ma c 

not matched when compared and function oi the-hardware processing speed, 

largest dependencies in design of the CJEE, 

, tho afi«; will be the decision policy implemented. We will 

°^so^ 

would be required for the CIDR. 

. aoHslnns relating to biometric match decision , . nr 

Decision system. Policy decisions re y . M the database search, determine matches or 

•■accept/reject''decision based on the system policy. 

. that ran be taken in a civilian scenario: ... - 

The T. ar pcr < inrr P n rr°»- h for-an«.riistaoce- low er qhan..a^xed t hresholdand "accept 





In general, lowering the number 
The optimal system policy in the 
► The statistical charactei 


istics of the comparison distances coming 
The implications of false match andfaTse non-match within CIDR 


pn the pattern matcher and 


on approach along with illustrations of how they w 


In the following sections we have outlined o' 
back to solving the problem in hand. 

Determination of the system throughput required ,or the Technology Architecture to he designed. 

The System Throughput WKHfWtjg System Throughput requirements for the - - 

- following is an illustrative approacn uwi ^ 

cm. n 

Sy 5 e^le e of°prTnts C As Vrecise D iwrfoTni a ance W prediction C wil[clependuponsystem Ssion policy. The approximate 
eguatiorffor ?he system throughput rate. T. depends upon: 

* the comparison rate, C 

* the system penetration rate. Psys 

■ the number of records in the database, N 

used^! me number of fingers collected, upon which ensemble bmnmg ,s performed. 

... . hn done on a subset, m, of the collected fingers. M. Any matches 

'^"any ££££** «* remaining M - m fingers. Under the assumption that no 

matches will be found, the throughput rate can be written as: 

T = C / (Psys XU x m). 

Changes of assumptions regarding fingerdKTeasing 
throughput. Any matches found (false »r®« Th ts "hput rate must match the customer input 
throughput, so this eguation “requirements. Assuming that the applicant throughput 
as averagea on a w j _ si _ r . an wriha . 
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;ing the abc 
a. SysU 


‘ equation, the following simulations couli 
i throughput required - which will define i 
r of Comparisons required per second -1 


I be done to determine the following: 
the overall performance requirement of 
vhich will be a key selection parameter 1 


matching engine and 

Number of Operational Seconds required per day - 
CiDR- and the computing capacity required 


I determine SLA and OLA requirements of' 



Assuminq that the enrollment program results in increase in CIDR data as projected by UIDA1 i" 
aDDroach paper appropriate trade-offs would need to be made between the required performance of 
the biometdc matching engine with processing power for design of theTechnologyArchitecture. 

The following key inferences can be.derived from the above charts: 

- ' • - -■ ; 

9 Refer page 15 of UIDAI approach paper HSvf s\v 
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a. As data increases in CIDR throughput will reduce exponentially. 

_ t>. The strategy for-enrollment will need to be aligned to system capacity growth. As can be seen, the. 
current enrollment projections will result in a sharp spike in computational power. 

► Increasing system capacity beyond a point may become a constraint or economically unviable. 

■ v :. . Jhe MSP may. incur maximum costs of hosting the. CIDR infrastructure during a certain period as 
per current projections. This may need to be taken into account in designing the Technology 
architecture and the PPP model. 

The above inputs on requirements will be used to design the Technology Architecture. This is discussed in 
detail in a later section of this document following this part on biometrics 10 . 

Encryption and compression in transmission and signal processing subsystems 

A very important design consideration is the balance that would need to be achieved in design of the CIDR 
between: 

► Data compression and how it will impact quality of biometric matching 
*■ Data encryption and how it will affect speed of biometric matching 

The biometric data for CIDR is likely to be transmitted from a large number of locations. Fingerprints and facial 
images submitted to a centralized system may come from widely distributed sources. To minimize required 
transmission bandwidth, data compression niay-berequired.’A-need for encryption may also arise.; 

The signal processing sub-systems downstream are designed to process the original image, so expansiorrof tire 
compressed image is always required prior to processing. The compressed image may be most suitable for 
storage, however. Compression/expansion may be "lossy" or "loss less" with regard to the quality of the 
expanded signal, but lossy compression algorithms generally result in much greater bandwidth reduction. 
Compression standards for "lossy" techniques exist for fingerprinting (Wavelet Scalar Quantization, FBI standard 
IAF!SIC-0110v2,1993) and facial imaging (JPEG, as in Data Format Standard ANSI/NIST CSL-1-1993). 

Compression/expansion algorithms are designed and tested to work well on signals of an expected quality. If the 
sensors transducing the original signal do not meet the expected technical quality requirement (lower sampling 
rate, for instance), losses during the compression/expansion process may be unpredictable. Further 
complicating the question of quality loss is that technical measures of degradation (mean squared differences, 
greatest difference) may not directly relate to increases in system error rates. The relationship of sensor 
quality and compression to system error rates is relatively unknown for any biometric system. 

The signal processing sub-system takes the now degraded image of the original biometric pattern and converts it 
into a "feature vectorl". The intent is to distill into this vector the information in the original biometric data that 
is time-, presentation-, sensor-, compression- and transmission-invariant. These algorithms are always highly 
proprietary. They all share the property of being non-invertible, meaning that the original pattern cannot be 
reconstructed from the feature vector. Thus whether biom etric d ata should be compressed or encrypted is a 
very Important Cl DR design decision. 

Other key implementation considerations - Frauds and identity thefts 

The technology architecture has to a certain degree-dependence on the business process that will be designed for enrollment 
especially from the standpoint of preventing frauds, and identity thefts. Some of these considerations would be as follows. 


10 Biometric verification involves matching a biometric sample against a known reference of the same 
person to find out whether it is presented by the right individual. This is called a 1:1 match. In contrast 
TiN dedtoplicatiattfor issuance of theXTID. this would be supported hy_more biographic data 
'' help narrow the search universe and would be relativelyeasier (when compared to the ec 
arching etigihe) to ' 
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Biometric systems enrolment P rocess standardized and certified. Tt 

For interoperability purposes, the enrolment process i 

- oata quality control (biometric and non-biometnc) 

Usability for the enrolment application and 

Operator training for service personnel unders tand. the pur 

The individual to be..enrolled must be matte awaie 

The—al shouid have an opportunity to view and verify whether the i W 
,e eguivaient and acceptable fallback solutions to prevent d,scrim 
• ' lometrlc traits). 

e cenined procedures for "urrenralment" or dati 
sed intermediaries and transparency must be offe 


ge of the application 
sm collects is correct. 


modification, op 


Biometric data storage 
Some of the following considerations would h; 


encrypted templates should 
• "Ihould not automatically lead to the connected personal dat. 


i impact on the technology architecture. 

, high definition photo of a fingerprint). Instead. 

' reduce the risk of identity theft and 


-M rya.” ra „ in< m «.«. 


Biometric ..U *»«V —, ——■ ~ 

Since biometric technologies attempt to addres V security practices may be m 

rtetaii and at an international level where possible, for instance, 

V when usin g biometrics for a secure identification process, the compete secunty cy* — 


,ne biometric identifier .e. 


Multimodality (meaning-more 

sfyoofiriQ yje|ds , he highes t security level and may therefore be preferred. 

Matching agains ement proces scan help protect personal data 

- implementing an effective key maiwy v ^_ ^ ta the different pior 


detection, especially in unattended 
cognition and fingerprint) may help prevent 




ire available ar 




Design of biometric algorithms 

Competitive evaluation of technologies and algorithms 
■ is SU es involved in practical implementation of biometric systems, ai 
• issues involving security of biometric systems as a whole 


jj assist UiDAi in taking key ddsign decisions and would be of significant 
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Description of Approach & Methodology 


Parallel high performance search h hov , can we exploit parallelism in the 

'SSSSUXm E*»» *- »««“*» 

Shown below is an illustration of how the implementation will work. 



HDFS: The complete Introduction to I 
paper. From the perspective of an er 
CRUD actions on files with certain di 
there are "Name Node” and "Data Nc 


S and how to operate on it is beyond-fhe-scope of this approach 
;er, HDFS appears as a traditional file system,You can perform 
Dry path. But, due to the characteristics of distributed storage, 


The Name 
metadata i 
determines 


master of the Data Nodes. It provides metadata services within HDFS . The 
a file mapping of the Data Node. It also accepts option d - 

which Data Node should perform the action and replication. The DataNodr 
for HDFS. They also respond to commands that create^delete. and/ep)ic| 



















inhTrarker and T askTracker: When an application is submitted, input and output directories contained in 
the HDFS should be provided. The JobTracker, as the single control point for launching the Map Reduce 
applications, decides how many TaskTracker and subordinate tasks to be created and then assigns each 
sub-task to TaskTracker. Each TaskTracker reports status and completed tasks back to the JobTracker. 
.Usually one master node acts as the Name Node and JobTracker and the slave acts as the Data Node 
and TaskTracker.---- —" _. 


Relational Databases in the context of CIDR 

Relational Databases are typically designed for Transaction Processing. The data partitioning would definitely 
help inimproving the searchperformance. RDBs would be very much needed for uploading the data into CIDR 
repository because of the ACID properties. However for the high rate of search transactions, the following 
observations can be made: 

► Most RDBs cannot deliver required performance on commodity hardware. 

► For the required throughput rate, the hardware required would be enormous not to mention licensing 

► - Most of Web-scale service providers use Hadoop DfS because it meets the search requirements well and 
" it is free. 

► Many DB features are not required for the search that we are interested in. 


Concluding, we see that appropriately sized, cost-effective combination of an RDB and Apache Hadoop can be 
considered -for theCiOR solution. Such a solution is feasible and keeps the TCP comparatively much lower. _ 

An example enrollment flo w , 

The search proceeds in parallel on each biometric, say for each finger. Based on the multi-level partitioning, 
based on the inputs the applicable data-set are identified. For each biometric, let us say that we use Apache 
Hadoop. The attributes of a biometric can be used for parallelizing the search in HDFS. The resulting set is 
quickly narrowed down and the decision can be made. Exceptions are sent off to a different processing flow. 
Once we know that there are no duplicates, the enrollment data is inserted into a RDB. A copy is propagated in 
real-time to HDFS, _ - _...... — . .. . . t 


Reducing vendor lock-in and addressing issues around international trade restrictions 

Based on the illustrative approach we have provided above.' we would like to highlight some of the following as 
the key measures we will undertake to reduce vendor lock-in and address issues around international trade 


Use of commodity hardware: Through smart architecture design we believe it is possible to use 
commodity hardware to support CIDR operations. An example will be use of 4 to 8 core system versus 
64 core systems. The bidder shall be required to investigate and assure that even in future there won’t 
be any foreign Government export control. 

. Use of multi-source or open source platforms 
. Use of standard processor architectures so that it is widely available 

No use of software whose Intellectual Property and source cannot be assigned to UIDAi 

Virtualization to remove hardware dependencies to the greatest possible extent - 

,. Treatment of licensed software: Ideally any licensed software must work on more than operating 
system. It should meet goals of interoperability. Data stores must.use configurable databases and the 
schema must be open for inspection and allow us to write utilities. 

. Security systems: Any security (encryption) scheme that exploits in-built security features of the Unique 
tD itself for requests or responses will be preferable to security products that need special approval from. 
foreign source governments. 

No products from countries which are not very friendly with India. 

are whose interfaces are not open-and not standard. — - 

JJIJqducts used shall be e> 













l Methodology 


k JfD Cl DR Consuuan 



Hadoop, W3C web services, http,.ANSI SOI etc. are good examples which satisfy all the requirements. Similar 

ideas could be explored during the course of the engagement. 

Workload analysis and design of rechnology Architecture ^ Qn biometric matching, inputs may 

Based on the business analysis similar to the one s h infrastructure. Projections can be made of the 

be derived for Workload Analysis and Design «* «* overai ICT ,rrtrasu ^ ££ m0(Jes These can 

required database size, data write speeds ana o _ cvuinwinn are illustrative charts based on the 
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► Address a multitude of risks/threats including geo-centric, personnel, technological, malicious, 
infrastructural risks, as well as program risks that may arise due to potential pofitical risks or loss 
/decrease of funds 

Tiain the UIO staff on 8CP/DRP through training and awareness workshops and . 
k Develop a Crisis'Management Process. 

We will use our EY global methodology for Business Continuity Planning as a base to start the project. This 
methodology will be aligned to the BSI BS 25999 standard. The diagram below illustrates our standard 
methodology for Business Continuity Planning which shall be used for preparation of the Business Continuity 
Plan for the CIDR. 



Approach 1: Replication by Storage subsystem 

Writes are intercepted by storage subsystem firmware and written to other storage subsystem. Servers are not 
involved in replication hence independent of server hardware, system software and applications, in storage 
subsystem based replication method, data is replicated by storage subsystem. All writes are intercepted by 
storage subsystem firmware ancLwrittento^pther .storage subsystem. This replications independent of server 
hardwareroperating system.-Foilowing is-a pictorial presentation-of-storage subsystem based replication 
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Storage network based replication 

in storage network based replication method, the data written to storage subsystem using an appliance at switch 
level and this appliance copies data to secondary storage subsystem also. All traffic is directed through an 
appliance, there may be a performance bottleneck with Increased volume of data. This type of replication is 
completely independent of either server system or storage subsystem, hence ideal for heterogeneous 



Approach 3: SOL Replication 

in this method, the replication feature is built into the application where the SOL queries are performed on both 
data stores. 


SOL Based Replication 
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ucsen P llon ° r Approach & Methodology 


* Secure by Default 

* fail Securely 

*■ Open Design - Avoid Security by obscurity 

Minimum Required Functionality - Reduce Complexity 
' Minimize User Controllable Input - Reduce Attack Surface 

cImmonMechanLm 9h M ° dU ' ari2ati0n " Helps with Economy of Mechanism. Sin 
Establish Conservative Trust Boundaries - Regard External Systems as insecure 

'V° “ e usea t0 ^fSInHonSSovrde the same » 

the infras^ur^^^^^^ ont^d 

^onaflnformaBon T Fom the re trieved b*”^is slhn ? 


Th V v ° Steps lnformation Security Architecture , 
e^ey work steps lor design of Information Security 

Formulate an information catalogue that sei 




m inventory Of alt informaUon managed by the 


l C ' aSSi,Y the inf ° rmation «s sensitivity / criticality 

info n rmLon C r U ,a tV f ° b r t ' VeS (COntk “‘V. integrity, availability) based on th , 

nrormahon classification exercise cased on the outcome of the 

l T erUm the SVStem ' S USer P0PU,ati0n and foment the user access channel, k 

sy7j*ZtlYs P T mg enV,Y ° nment ° f the astern and identity con^I ^ 

the system under development interfaces with Y a,nts ,mposed b Y external 

* PncZ^T CenMC ' SYStem CenMC and att3ck centric modeling exercise 
threats and identify relevant security controls 

intended user base, its cperating^^ Processed by the system, its 

Methodologies to he _ aCe 

Data security is one of th p ^ epare the information Security Plan 

‘Ws. wewewin n * n ®9Mof 
b- Prevention of data ieakage e oundahon °f information Security 

c. Data protection program and - 

o. End point security_ 

Methodology for data classification 

OLt.t S d a^uch ^ndament component of Data Governance and in, , 

compliance ^° Ugh app ropriate governance ZZt? Mana ™t 

and industry leaLg prachces to ^ Classificat ™ Methodolooyls btZ** aChieve user 

x ^ thp r-assificehon o, informal^ —nance 
































rotection Program for CIDR 
pe. distributed in its implementation, 
amplexities, a Data Protection Progra 
' feaiized in the enterprise, 

a protection program to reduce risk, 
ery. and comply with internal and re'c 

the nf rino ^ 




roi effectively 


i effectiv 
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': Part C Description of Appro 



£££ Zlssaalna 1"" be Used al °" 9 with methodologies for other 
secure messaging while creating the Information Security Plan and Procedures for the 


relevant areas such as 
cidr: 


Design of non-IT infrastructure 


■ . tnterjflos 


design and architecture of Data center shall cover the fo 












Electrics 


- k Eire Suppression 

* Security & Surveillance - . - - 

* Building Management Systems and 

* Miscellaneous Support systems 
Minimum N+l engineering approach 




a listing of key activities that will be ca 




The 


fltaors: Detail design shall be submitted indicating the size orientation ,• 

for each compartment and storage locations. Conceiving the nncurr^- 7 L ^ * ** P ° M ' 

construction drawings shall be issued to the site Catalogues fWm U,DAI 

ITLT'VTl '* Pr ° Vided t0 the «"* ** -S f L“dTatlernso7 ' 3minateS ' 

^ I ems s all be signed off and accordingly implemented 

carried out to ensure quality durir^the'mcecutio^phas^*^ 00 ^^ SG * ec ^ on - Periodic supervision 

* m r -—— 

: 

■ De ^*d design showing the location of various lev , 

geometry, fingerprint, push buttons, closed circuit tetevM SeCUnty lll<e reader - btometric Mm 

provided to suit the requirements of the data cenfer ““ a " d Security desks shall be 


r^L DeS ‘ t 9 l! S and drawings once issued to site shall not be rha 
earned out by conducting Joint meeting considering'7e impac? 


^changed. Changes during implementation shall be 
pact on cost and schedule with mutual agreement. 


igrequirements: concentrated load static uniform floor n 

uc unuorm iioor load. Dynamic rolling Joad) 






'JIDCIDRC6 


* Service clearance requirements (clearance 
adequate servicing of the equipment) 

*" Counting requirement 

* l DC power requirements and circuit length res 

* Equipment connectivity length requirements 

* Support area requirements 
► Security requirements 


uipment required to 


Electrical services 

notbeavSable a ' S ' ,Stem 

ID^MutiCeTSS a nTp CaPtiV nfa eratiDn Planni " 9 wi " " eed to be ™de tosatisfy the upt,m1needs of the 
ult. tevel Redundant Power. Bondmg and Grounding^ Separate fault-tolerant supply wilTbe plMn^ 

Mechanical services (HV AC and others) 

server room so as not to introduce contaminants from other areas. 

hotspots dCTelop^tWn^the^rverroom TtVAC f°? e ‘ f r ^ <,u ^ ed ' ver| fy appropriate airflow and to ensure no 
positioning will stand up to HVACw°t fTitur^ withoXreZ h°? T the HVAC air ^ handlef 
inciude Leak Detection^ysS^^S^^ — « wii, 

Fire protection 


I extinguishers will comply .. 

gh Sensitivity smoke detectors, wi. . 

used. Suppression system will use Pre- 


NFPA. Design will include methods for early detection 

safeguard from false discharge of 


Fire protection plan will take tnto account risks in following order. 

Safety of individuals or property affected by the operation 
Fire threat to the occupants in confined areas or the threat to exposed property 
" ECOn ° mk loss from bus 'ness interruption due to downtime 
* Loss from the value of the equipment 
*■ Physical security 


Physical Security 

Security is given a careful consideration, and based on oDerati, 
designed to enforce Physical Security of the Data Center. ‘ 

*■ Sin 9 le Entry and Exit for Normal Activities and restrict! 


requirements, following mechanisms may be 
access to personnel 


Entry Portal scans with metal 
Digital Surveillance Cameras with long Retention 

State-oH^Art Security Monitoring Center. Perimeter Security..individual. Server Cabinet 
of ion Sensors at Critical Equipment Location arid secure rooms 









■facility! 


be designed to m 


Building management sy 

caiweof n toL h |Vd Stem Wi " b ^ es ^ °e 


e development w 


i; 1 ®!® ■ 

ild include: 


men da t ion 


Project management 

Key project management activities for non-IT infrastruct 
* Development of project plan 

Appraise delivery schedules of lead equipment 
l ^ nSUre aP com Ponents/items used are as per specifications 
Ensure all contactors follow safety norms 
* Co-ordinate With UIDAI for any clearances from builder 
" iostailation activities are carried out as per consultant re 

Build out resource management 

Work With Facilities architect and ASE firm to ri I t,es We Wi«: 

> 6nSUre cornmun ication through the management approval ^ deS ' g " Chan<Je -quests an 
Maintain a decision log that will provide a source „r , , 

pertaining to the construction of the associated Data Center*™ 6 ^ 3 " approved ™nagement decision 
* Construction As-Rniif- u/ n rL 

operational procedures and futurepUi^are a™™ 1 ^ ME Vendors to ens ore that facility as buTt 

!ZZZT ‘,“'... octp . 

cation to all appropriate parties. 9 reviews, documentation, approval and 

Facilities turn over management 
We will collaboratively define and document: 

Commissioning and acceptance testing 
_ Punch-list items and management of delivery of resolution r 

Procurement challenges and our solutin items 

y anQ our solution approach 
A key success factor for the UIDnrnnri. ■ 

related to the C,D R thus have two^So %»**«*** of the CIDR. The procurement cha 

Creating a self-sustaining model and 9 

It i?: evident that the peak load scenarios fnr r,n D ,, 

w«fhTve a a d very^ p n 0 0 r t t am P0SSib '| e ‘° predid PerformaS'ot^sy^TfjT Y “ r 5 post Go ' L -e of the 
° n **** na,ure of •’“'^'private 
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Description of Approach & Methodology 


► Method oi sourcing • Single stage versus two stage bidding 

* Contracts - Single contract versus multiple 

* MSP Contract structure 

.Retentionof strategic control over CIDR assets wjth UIDAI 

* Total Cost of Ownership 


Single Stage versus Two-Stage Bidding 

sjjs ss x o^Zthf 9 ado r at a scaie wthert ° not 

high degree of confidence wfuie outconws°o^ustify ?he'effo™and o^fronUnvSment^it shali°entaH ViC * eS 

Tw^Stege Bidding 1 .' 3 ' f ° r ' CT Pr ° CUrement aS practod — «* -rid, namely - Singie stage and 


► Two Stage Bidding: In the case of turnkey contracts or 
a special nature or complex information and 


r large complex facilities or works of 
lumcation technology, a two-stage bidding procedure 

... ..^ al Proposals on the basis'of a conceptual design or 

"cations are invited, subject to technical as well as commercial clarifications and 

technical n , a ~ ‘° ** fP "°" ed bv amended documents and the submission of 

technical proposals and priced bids in the second stage. 

at^he sol^fon'spec^ficatfons *° T ^ 

bidders to gain complete understanding of the M^exrty^s^ *° h *‘ P *** participatin< ! 

► Single Stage Bidding: In this method, bidders are expected submit final technical proposal and priced 
bids based on the information provided in bid document. P P d PnCed 


The apparent advantage of the two-stan*» hiridmn ic fhat .-f ... t . 

by seeking inputs from multiple players^nd also allows nrnnf t ® nha,Kep ’ ent of the solution specifications 


Factor^ fi r \ ^ >v J 

Single Stage Bidding 

Two Stage Bidding 

Capability available 
in the market 

There are not many cases of such large 
scale and complex implementation in India 
and across the world. 

Two Stage bidding may be able 
to provide the 'learning curve' 
and allow usage of collective 
knowledge towards solution 

Specifications for 
the hardware 
-infrastructure_ 

In case of sizing of fT infrastructure, 
information inputs for volumetric analysis 
. could, be provided based on historical data 
with reasonable assumptions for forecasting 
hence reducing the degree of unknown and 
complexity in the stated procurement 

UIDAI may be able to assess the 
hardware specifications better 
after the prototyping stage 
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Solution and Vendor Evaluation 

provided in the bids meet L ret^ “•« Materials as 

' sss " m “ « 

«■* o« » »«»<, «. Mmiimm o. u»«, ™wi«- 

" I:;' C :: ard ; are ,r/ ,0rmanre t**"* - benchmarking exercise in a controiled/iaboratorv 

environment could be made for the hardware oroDosed hv the waaL. , /iaeoratory 

laboratory on Its own or instruct iJl b,lid6rs - UIDAI choose to setup the 

Single Contract versus Multiple Contracts 

We understand from the Terms of Rf»f<iron/-o rtr-nwieivv^ _ 

MSP, Data Center Service Provider and service providers for 3 separate contracts with 

Tare some of the factors that need to be comirteJLi fAr h^h nter, ^- co '. ,ocat, °MaciJjties respectively. Following 
combined. need^o be considered for deciding on forming the contracts separately or as 


Factor 

Single Point of 
Contact & 
Accountability 

Single contract can help assign 

contractor for all the goods and 
services and they meeting the 
required performance 
requirements. The contractor 
may internally manage the 
dependencies on the delivery 
with sub-contractors and OEM 
without transferring the liability 
onto UIDAI. 

Multiple Contracts l - 

Multiple contracts require clear definition of 
the responsibilities among the contractors for 
infrastructure and services where there are 
overlapping responsibilities and dependencies 

and vendors will have to be cooperative E a If 

the availability of the software system to end 
users is dependent on the availability of the 

Data Center which may be managed by 
another contractor. 

dependency on single 

Given the schedule duration of 
implementation, the variety and 
volume of procurement, relying 
on a single contractor, for all 
packages (at least 1 to 3 ) could 
expose UIDAI to significant risk of 
delay and discontinuity should 
there arise issues and conflicts 
with the contractor 

on ottefprtcurem^nt*'^ '™ eU " 

Interdependencies 

In case of transition from co- 
location facilities to dedicated 
data center, single contract shall 
avoid the need of efficient hand 
shaking between two contractors 

Such a transition shall require high level 
dependency between contractors and increase 
the risk of successful transition 
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Cor'oW DID CIDR Co 




itract - Contract structure 


MSP Cr 

Contract structure shall be based 

>d Payment or any other. 

H’ of the elements of 






type of business model adopted for engaging the MSP - Revenue 
th “ of the PPP model, whether BOT, BOO or BOOT wi 

he contract that shall be dependent on the model. 


Duration - - - 

ixoeded Do?UmmZrlT del ’ w‘ ers ,hdt sha " driue lhe decision the Oration shall include 

“ P f' od that the solution ™V re P u ' r e to run in stable manner based oh the load 

revenue sharing (with little or no payments by UIDAI towards 
“ tpected period for recovering of the costs froi 


ir. For contract ba 


requirements each' 
setup cost), the duration shall also co 
portion of revenue that UIDAI agrees 


th MSP ev 


the 


Many contracts adopt payment terms, 
contract with MSP, given the nature ol 
partnership basetfapproach that allow, , u , 

timely maoneyyhile ensuringjhg payment is results or milestone I 


a mechanism to control performance. However in case of the proposed 
rork and role of MSP is the success of this project, we propose a 
.ompensating MSP for the high capital and operational expenditure in a 


In case of Revenue Sharing mi 

vt1iht^ C a^tf^Tmt abl,i r V 9aP ? Urinq thecc "‘— - — «—» options ror oompr 
viability gap, for example, in form of payment of a portion of the setup-costrif the contract pc 

Total Cost of Ownership 

increase scale of adopti3 SteUTOiSSS ^Tp^rtunTtyfoVsavings 

exercise the option of seeking revised quote for proposed hardware hac tha nrA w»*fV - A C f 


;e the option of seeking-- IWI u 

time of revision and the savings thus identified coul 
alternative, UIDAI can request for latest versions of the 
savings thus identified. 

Retaining strategic control over CIDR assets in ar 
Al envisions adoption of outsourcing at a sit 


based on the prevailing market price at tlw 
deduction in contract value or as an 
proposed technology at additional cost that covers the 



we refer to brand in context of this project as 
UIDAI's image, quality of service, values, eto 
"reliability", "transparency", "responsive" an: 


ill the associations the external stakeholders shall ha 
Id some of such associations that UIDAI would like to 
"welfare focused". 


cai^l?Hy assessed^by UIDAI^r'the°u^ccesTonh d ° P T C f an<1 ' f, t e ^ have 0n !he brand <* need to be 

stakeholders. Forexamp^ of wide acceptance among its 

V c. wtf uibcuss oeiow the potential impact on outsourcing models on th- ~- 
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..ssrsajsaa 

services thus nay mlluence the UIDAPSrand U ' D 111 mertetirej run ~ 



As Option 3 is more 

Among the other two options. Option 1 offers uinai m 

sF^ 

not realizing the revenues from the opportunity identified ‘ may a " e9e lack of act ™ f™m UIC 


iUnff 6 °^ ,on onus of brand management falls on 

SSS*' ,iv.l!l,™, h . 





In an outsourced model, the^Mernat Vendee ^"m™ 1 ° n 9iven the sensitiv 'tv of the 
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emiriation services. Following arejoroeof the measures that help in- 

witti private toy of authorized UlOAl personnel ~ 

vew and maintain the data shall be managed i>y an authorized UIOAI personnel instead 
to view the data (restriction on execution of SQL Iriie SELECT) -_ 


Given the national importance of tt 


SS' a iS SU99eSt ! d that a " «**“• assets - IT and Non-IT 
-ontrolled by UIDAJ. As we exoect the rennircmonf^ , 


the infrastructi 
asset management activities shall be monitored by 
Operations 
We assume 


varvlno deoree ran ri Wned ^ tern.- The management of 

varying degree (as discussed under heading 'OperSiorrs r ) However all 
personnel. 





Intellectual property and transfer of technology 

M'th^envjsaTOdsoluti'^T 15 fela * e<i to ownership and rights of 

in undertaking large scale international ICTproVu^meoK P ? Viders and 0EM suppliers. Our experience 

helps us provide insights and leading practices on bu*£ Wor ' d *■* 

Procurement decisions related to Intellectual Property Rights V' 

- . e procurement-decisions related to IPR shdWhvohre copyright and usage related rights on; . ' 
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■5, procedures and algorithms 

s, procedures at 




systems/components that will be developed in the proposed p^ojjct aPP '' Cable ,or custom s0,twa ' 


broad spectrum of strategies that UlDAi r?n la * 9 ° vernment agenctes in future. However there is a 
it is important to identifyTeCul^ T"?^ 1 Pm ^ «**» in custom software an 

- elements and assess their importancetndividuilmforedeSnn'nn pr + 0prietar '' P ractices - Procedures) 
-UIOAI should.enforce.__ _ rawtsuanvrbefore deciding on the nature-awhdegreeof-fP rights that 

-- °h standard software, whose nwiwchir, « ?. 

adequate provisions to UIDAI in its usag P e as per itsTenuh^T' d*® liCense a 9reements should be .offer 
restrictions of Standard software lice^s") shou d Z Z 77 Res,rictions < 5 <* Box - •■Examples of 
where required to either relax or remove any of-such^rict^s^^ "* Sh ° Uld be ««*»•< 


Examples of re 

a. Restrictions on t: 
held by the systei 

b. Restrictions on the numbers of transactions 
may be processed by the System in any < 
specified period 

c. Restrictions on the number of persons who it 
system at any time 

d- Restrictions on the number of persons wh 
simultaneously at any time 

e. Restrictio 


in standard software licenses 
ds in particular categories that ma 




i particular categories that 


:r of workstations that may be connected to th 


:] 


Technology Transfer 


Of upgrades or customizations in future 


important that adequate pr 


iutions are taken to ascertain the ' ruup ' lcatlon ' Nai 

su P P l"y of^softwa'ehe^p addre^thV^o^ern, 06 ^ 




:h arrangements generally cover: 


ie Source Code to the e® 


The Supplier’s warrants'th"at tteSource Code is at all tin 
executable code to the relevant Software in use bv 

support and develop the Software; 

I'S Obligations to keep the Source Code so 


ke replacement deposits to 



obligations'in 


to verification of 


e and confidential: 
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he obligations of the Supplier and the Purchaser in re, 
he escrow agent's right and obligation.^ release ttv 
rents" Ce.g., bankruptcy or insolvency of the Supplie 


in specified “releass 


Limitations an 


>w agent's liability, 


vm ' the escrow arrangement *UI terminate^what will happerUo the deposited-Source 

I*. Confidentiality undertakings to be given by the Purchaser on release of theSource Code. 

The protection provided by an escrow arrangement, however, should be weighed against the costs of administering it. 


f",n'.? nC rl n de bV Sta v 9 lhat EY ' S experience in assHifig leading International Financing 
institutions ( IFi ) and its association with complex procuremehf activities such as those for an - 
important intelligence agency of the Government of india and one of India's largest tax 1 
administrations has allowed us to understand a wide variety of issues involved in complex technology 
• We -'1- able to doliver this expertise to the UIDAI for a successful implementation of 

Case study- Identity and Passport Service. United Kingdom 
Executive Summary 
Identity assurance is 
people need to be ab 

IstehHsTam IS h eed ' the UK 9 ° vernment has ,au " ched the National Identity Scheme (NIS). which will 
establish a much more secure system of personal identification than is in place today The NIS is one 

prwams^^u^^Tk a " m r" 9 and politica,ly sensitive technology-enabled transformation 
programs ever undertaken in UK Government. The Identity and Passport Service (IPS) created as an F*er,.Kw„ 

^~ fiCe in Apri ' 20 ° 6 ' - -the Schem^! The UrsUdentity ca^ds^ere 


At the outset, IPS needed to establish 
this complex ten year transformation 
a shortlist of approved providers, it needed. 


group of suppliers who would partner with the government to deliver 
Having decided to create a strategic supplier group consisting o 
rith deep experience of technology delivery ar 
“ --'"'ration. It chose Ernsts Young. 


ThemuitFdiscipiinary Ernst & Young team started work in June 2007. Within a year applyino 
Competitive Dialogue procurement approach, the team delivered a unique and world-class Frai 
agreement that can be used to procure any identity-related service4n government. 

The NIS Framework agreement was signed wlthhveSystfirns Integrators in June 2008 and v 
foMowed by the launch of two major program procurements to contract with suppliers to delivc 

Once again, IPS selected Ernst & Young to support them as client side advi 
and dehvery of these two procurements, which had a combined value of Et 
contracts were awarded on time in May 2009: 

► The Application and Enrolment (A&E) procurement selected a supptier to replace e> 
processing passport and identity card applications in the UK 
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technology pTatform that supports biometric vi^'^ForeigrrWaUonafs' 9 ^ emi " 9 . 

Approach to Delivering the Procurements 

At the outset, Ernst & Young mobilized an experienced team tn Hoiiwar fk 

and Young team collaborated with the Ci^i Serace tea^in^ha^fgrmanag^n^mTdeliv^ng theprocurernents 
Framework Procurement: Strategy 8 Planning 

Government CommeTci'foG^^ Director and the Office of 

issued to the markeUn August ^007. ’ ' 9V fo the MIS The ,eam developed the Prospectus7 ‘ 

Framework Procurement: Pre Qualification Questionnaire Stage 

Integrators progressing to the Dialogue Stage. ed the evaluation that resulted in eight Systems 

Framework Procurement: Competitive Dialogue Stage 

with each supplier. Senior Government Officials In • P ^° d ‘ over 100 detailed dialogue sessions were held 

diatguf exnenenced 1dem0f “9 commitment at ‘° “ ld lon9 ' erm 

uiaiogue, experienced commercial and financial A| ongside managing the overall 

comm ercial dialogue, resulting in a common"™Scon ™ b ™ng tSSTS" 9 

9 agreed b y all potential suppliers in mid- 

ement: Contract Award Stage 


March. 


Program Procurement: Competitive Dialogue Stage 
Following the award of the Framework, the EY team wnrPoH i 

“os ™ iSlncluded P™J«Ct mana™ment r0 dev^mint S o h f Pe ’ ma " a9e 


commercial/finaneial terms anu „•-._ v 

“""'"’ling support, requirements a^ S ev^i^io™and'down 


rd Stage 


^-government stakeholders to manage the approves to 


Program Procui 

Following final evaluation, the EY team worked i 
award the A&E and NBIS contracts in May 2009. 

Challenges to Successful Delivery 
The outcome is widely regarded as best in class oror.,reme„i 

learned from across government and received commendsv7 T UK p overnment ' building on previous lessons 
e ® m ain r ballenges faced by the team were: r ° m lhe 0ff,ce of Government Commerce. The 

pie* procurement in a.tight.timesaJeJhat Had never 
If "“T " SU,,ICier>Uy WHe support a wide range of fu 

■ l W 


I achieved before: The . 

services, from Secuie 
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*** 8uSiness Process .Outsourcing. It also needed to b . 
1 9 SW er ranoe of Idenhtv r»i 8 t e g services across government 


Developing a contract t hat was innnuaH 
that it incentivired suppliers anb.y,.. 
protected the publjc.4>uisc: Arrange of 
mechanisms to deliver value lor money to 
Home Office sit at the heart of the contracts 

g strong trust-based relationships with futu 
are built around the principle of partnering, 
and contractual Partnering agreement, built 


contracts 


ppliers that build upon IPS values: 
id behaviors, was developed jointly w 


M - S rri " if ' ^’^'rlimncntarj H..<ler-SccreU^for Identity,: 


litZlTa' ' 7 " '‘‘'.I!"' °" e ° f >he best procurement teams in the Government ™ 
nun me scheme. We went through a verv cfTectiw nmt ,, r <„.,, a 

aZraZn ZoTZ^^^/^b “”*'**$ W * ^hmo'e' 

'rues,hat are w being sutte" '* “ c » m P^ heatedly for various 


Creating a self-sustaining revenue model for CIDR 

At present, the CIDR is oronoseri 
mode,. Setting up and ongoing operations 




it is, therefore, essential to create a self-susfvUm™ 

0ffseUhe S c rV | CeS t0 b0th Governmen tal as well asoth7age™es el *777^ ”'7 proposition b «ng offered by 
mCUrred ,or settin 9 OP and managina the ^rDR A T, * ' ,he reuenue m odel should 

In^he foNo" and fund ' n ® su P port is rer^ir^^rom^tte^wCTi^CTrt on^7for°the ODr!^™ & 

CIDR. We could 9 enhance ttedu^ngT^ revenue model ‘hat can be created for the 

Potential services which CIDR could offer 
Conceptually, based on the •mandatorv'ir inform^™ 

services could be offered: mformatiion proposed to be captured by the UiDAI, the following basic 


g°o*7: 
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so perform the function of da 


Broadly, one 
carriedtout?. 

Approach t 


■ ' m °» .he above questions is developed, the foliowing detailed analy 

»identification of revenue streams 


.«... ) , 


^approach based*<»rt«ngtrFollowing is 
’ ' ■' ‘ > R services on the following twacritena. 

1 !' lr ' Oasis of the following sub-criteria; 


due potential for a DR services; This could be 
Potential vc 


id therefore, there will be a steady neec 
le basis of overall value ol 


Identity verification is mandated by regulatory/ compiiance requirement 
Current cost and time overheads of identity verification 


"tv ° f taPPi " 9 the revenue This could be assessed on the basis of 

Ease of managing the customer: It would Hp nrpfor=hi« + 

centralized management and who also provide aTaroe l m .T* CUSt ° merS who haw « 
the overall cost of acquiring and servicing the customer. (ran ^et,ons. This will reduce 

Likely speed of adoption and therefore, how soon revenues will accrue to CIDR 

ssed identity vtitot^ of a Portfolio of 20 services for 

«h and not an opinion about thelke,'^ * an Jll *“n 
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We have provided bel 
the CIDR. To do so, w 
benefits that may flow 




impact of ongoing e-Govemance and social inclusiveness Initiatives 
An important requirement for the CIDR would be ...s*u 

CloTwtJld be- rati0n r£t,Uirements ">*» < a " have a significant 

" a; ' Integration with National and State Service notion r * 

- - 

C. Integration with m-Governance initiation, r 

Mtcro-ATMs, hank,ng correspondents and the CIDR's revenues 

:r b i£I~ 

' ° ^ou,?^ es . a,3r9ese9mentof rurai 


ative S-ROI computations 

assume that the following could be some • , 

The need to nrnve ;,w-f , °^omes of implementation of the CIDR. 

need to prove identity only once will bring down the transactioh costs for the poor 
Clear Identity would transform the delivery of social welfare n 

inclusive of communities now r, ,t „« , * , welfare programs by making them more 

mmumties now cut-off from such benefits due to lack of identification 
Potential elimination of fraud and duplicate identities 

Inn^T!'* ° f ,0r P00r and under P r ' v| ieged residents into the formal bankinn t . 
pportumty to avail services provided by Govt. & Private Sector m 


For Registry 
Cost Saving 


S ' f ° CUSed Dn Soclal Goals . UID would enable them to broaden reach 
for Exchequer 

Key business model decisions 

following are some of the other key business model decisions whirh 

immary analysis of each of the areas Thafa ™ h a*, y need to be taken - We 
me areas. These may be further explored during the 







J* We estimate the ecosystem ot users may he to th 

efoped 15 . The costs of tracking each user may cub** the benefits 

welcenwio W6Wo^ a uniform price may need to be fimt for ail home ' tiat - 

systems which^e *** machine initiated - ‘here could be a need to tr 

*• This need may allow trackingof such cm 
in such cases, a subscription model for ire 

Prepaid versus Postpaid model 

tt e cZc^ofVre“ers e us ll7pM%7 e r^t^ ^ ° DR ™»*- ‘-this regard 

- would need to take. In our view S husiness m <>aoTdecision which UIDAI 
advantageous to the innai <„r .k„ P r<? sent understanding, thepreoairi monm n. 


w S T e ' iS a " mP ° nant •’-ness modoTa^isToi 
or «?£understanding, the prepajd me 



The business model revolt 
need to be addressed pritr 
verification through CIDR 


<9 around CIDR 
riiy through ere 

services initiated by I 


Other business m 
There are three bi 
strategic control o 


service delivery procedure, 
considerations 

el considerations which ns 


may be subject to privacy concerns. This ma 
’ legal framework. In majority of the cases Y 
*"■ *- resident. Assent of the resided cc 


h. Who will design CIDR services*, 
_ C - Who will market CIDR services? 
These have been discussed in deta 


maged Service Provider. 

emerging opportunities? 


16 secti ™ Pertainmg to ProcuremenLChallenges. 







W r;'° r initiative - Biometric voting 

; . rs ^ 

- ■»**»««».- IM .„,SSSST 


s SSSS==S-; 

























action security in banking services - Biometric vaults and ATMs 

banking services, such as access to lockers/vaults, high value monev franc fore <, r * 

s, payments could be taken on a per transaction basis with 

Issuance of digital signatures 

aDerson'atThJ tvf *° S “ inCTeasi "9 usa <* «* digital signatures. Establishing the identity of 

ca^be^g^ificanHinkages'tet'ween't'hp s '^ nature ^ ! s an important activity. Going n forwardlhere ° f 
identity verification. ^ p ocesses of 'ssuance of digital signatures with the CIDR for 

Issuance of Goods and Services Tax Registration Number 

process^amPndme^ 1S l ervices Tax C " GST "> re *™ in «* "ear future. This may see a 
numte? amendments t0 ex,StmtJ taxpayer registration and issuance of theGST registration 

Tax regime. One key^isk^" re|^d^o*VAT refSls "it?° f t '' e9 '^ ration numbers under a Value Added 
businesses with which an individual k a<cori a foa • ***' therefore - essential to uniquely identify the 






















■ mana Qement initiative. In our point of v 
cus on the project life cycle but also focu 
strates the likely nature of benefits that 
management.program is implemented vi 














Contract- UIDClDRt 




Description of Approach & Methodolog 



Engage senior 
change 


leadership team and promote creation of a change network le 



dUn ' n9lhe Projec ^ Management phase. Somekey steps that 

► Monthly status reporting highlighting achievements till date, progress vis-0-vis the 
original plans and key risks that are emerging and their mitigation. 

Workshops with enrollment agencies to help them understand the reouirements for 

integration with the CIDR and how to use the workflows created 

Gathering and assessing the feedback received from pilot phases of the project 

. Through review of deliverables and perfor— —-.— ■ ■ 

management of the CIBR_ . . „ „ 
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slst in development of managerial capacity 
ce the consultant's tenure of 36 months is 


management at 


knowledge transfer. 


n the f 


>e UIDAI to manage the project 
through effective knowledge 


Approach for technology implementation 
" Considering the exploratory nature of the technology solution t 
of software development may not be appropriate. In light of thi< 
development methodologies and these may need to be incoroor 
Proposal document for the Managed Service Provider. P 

!f„ SPd H n , ° Ur pl ;f s ® nt understanding of the challenges in CIDR implementation 
methodologies that we could evaluate is the Vinnfuse EnternriseS ?J he 
methodology. This is comprehensive light weight Enterprise Architecture Method nin^h 0 

leverages the best of UML, ICONIX and adds the non-functional t f 

*“ “»*»».»»»«“ ”" ms * “ “ - • 

Vinnfuse Enterprise Architecture (Vinnfuse EA) - 



methodology may deliver would be 


k Domain model 

* Class diagrams 

* Sequence diagrams 


► Code and Unit Test Results 

Assuming that validation shall be done by Ernst & Younn tt 
deliverable for Ernst & Young. 9 ' f 

Strategy for deployment 


f validation activities shall be a 


solution to stabilize. 


in illustration, we could co 


project revolve 
• - of view, we.may 

pilot rollout phase to allow the 

ut of the modules in the followinc 


Phase I 

• Biometrics data matching 
b,' Unique ID generation . 
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a. Support workflow modules 



The strategy for Go-live are tightly linked to: 

* Overall technology solution and the constraints 
development. 


may emerge during design or 


► Availability of finance and how funding can be done to reduce overall program cost 

* sr Know Your Resident ™* sh 0U id,actor P < 

ana tega support for the UID program, support from-key agencies which will enroll res 
and public opinion about the utility of UID. _ . 

CIDR 0n Keemnnth na9e jr en L PrQ9ram Wi " ^ keY to successful tmplementahon and Co-l ive of the 
CIDR. Keeping the above in view, we-w+Msojss the-following here- ° of the 

* KeV riSkS We f0reSee in Complementation as an outline of the approach we will adopi 
An overview of our globally recognized Risk Management Methodology and Tools - 

Managing risks in CIDR implementation 

, Wi " ^ the C ° re ° f the U,D SYstem - S-h a iarge system wl 
fail. Mapping the risk universe ^! 
approach. We illustrate our approach through some Sampfes Mow ““ reqU ' n " 9 3 StruCt ' 



ie risk universe for the CIDR program 
sy be created as illustrated below. 

of risk can be further analyze! 


The UID 
project is a visionary project that 
needs sustained support and 
adoption of both the Central, 
State as well as Local 
governments to deliver results. 
The legal framework around 
CIDR services is yet to be 
formalized. Any change of 
leadership or Government could 
lead to a change of project 


t project has significant poiitical and.legislative 
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financial risks: Two key financial risks for the project will be- 

° ,‘T" tY ° f the reVenUe m0del Pr0feCted for the MSP operating the CIDR services 

° rtZZor the 9 "* f ° r C ' DR and the approvals from Government 

for , . ere maVbe a PO^Mity or Strong, public opinion ememin 

op" a9amSt the C,DR< "’- > ^^Je5^timajJSm,rJ|JPi^ ' 


* Ad.option, .and.publicoBi nji 
Economic and Social Retu 
hinder adoption would be: 

° Concerns around Privacy and any mishaps or n« 
o High cost of compliance to registrars 
° Limited or no value seen by agencies using UID 
o Deliberate attempts to delay or deny enrolment 

lnLormahon^gcujity_ajK!JLora^majeure:The 

GfOR essentially has to be a zero-data loss 


gree of adoption will have significant impact on both the 
Investment in this project. Some key factors that could 



iignment involves significant I 

risks in the design, procurement and R .■■■ *§' ' 

implementation phases. Key decisions and/or delays mav attract d a - , ' * 

in turn affecting public opinion. This calls for stro J ^ ^ slgniflcant media al 

calls for strong project and risk management. 


rill use its Risk Manager Tool 
onitoring the effectiveness of 


Risk Manager Tool to manage and monitor Program Risks 

as ant^ he Complexit V of the CIDR implementatL lmam 
as an integral part of Program Management. P g m ‘ 

•Risk Manager- will be available to UIDAI the rnanana m . 
risk management across the CIDR program in a co^efSttveTrld 

mani 0 n eth nte9r f es " Sk informati 0" and allows multiple views and re J " 

manaQe the nsks “ a Process, on an ongoing basis reporting options to monitor and 

Approach for testing and third party quality assurance of CIDR 
fiK ke¥ qual,ty ***»“ activities that wil, be carried out during the 

implementation ronfi^rnTto varkaus'^sQ 0 ^^^^* T ' Verif V tha ‘ the 

UID standards specifications on an ongoing 
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► Functional Compliance: Ensure the system complies ip the functional requirements as per 
the specifications on an ongoing bases. We may develop test automation suites to aid In 
faster testing. u 

■ N° n "Functional Requirements Compliance: This will include verification of the following - 
System reliability, system performance, scalability, interoperability, energy consumption. 

in addition to theseAierifications we need to have technical and process audUs^nd various 
points in the life-cycle to identify issues if any and provide for remedial measures. 


rd party auditor shall be included as part of the te 
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Reporting requii 
the Project Mans 
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REPORTING REQUIREMENTS 


phase based on the folio 


: Consultant and the 


Employer dur 

































































































1 


► Identify revenue streams for the CTDR 

► C reate business case for the revenue streams ; 
identified 

► Identify and develop strategies through which 
innovative identity-based services add other 1 

value-added services can be offered by the 

1 1 “ 1 

.fttill i fi t 

\ 11 tl§j E | s| f 

mariitfi-. s 
Ililiij! if | 

! I! 111 1 ? j-i i 11 

Irfflllilflil 

A A A A A A 

► Design the data cebtrfc retjhirements for CIDRj 

► Specify parameters fir sel^P'on offsite for ODR 

data contra 

. 1 
4 



■ - 




f 

Principal Artihitec 


%- 

'f-m 

r End-to-cnd implementation of large projects from 
initial stages of scoping, techno-commercial 
feasibility studies to material / machinery 
procurement, execution to final stages of 
implementation, quality compliance and acquiring of 
statutory approvals 

* strategy formulation 

► Developing business models and revenue streams 

► Restructuring and Refonn advisory 

► Software Engineering & Methodologies 

► Research & Innovation 

► Solution Architecture 

► Managing centers of excellence 

► Deployment Architecture 

► Data center Consolidation 

r Designing data centers 

► Management of data center infrastructure including 
but not limited to Power, OPS, Cooling, Racks, 

ft 
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o Electrical j j, 
o Mechanical etc 
► Validate tlie specifjcjafiohs with 

► Architect and oversdd 
implementation ofNon-IT 
infrastructure reauirej for the rrtsit 

► Assist in development bf Disaster 
Recovety and Business Continuity 

Plans 

► Assist in the condudt Lf Disaster 

Recovety and Business Continuity 

Procedures i 

► Assist in development of 

Information Secufhy>litn and 

Procedures , 1 ; 

► Assist in conduct of information :j 
security related tests on the systesth 

► Review information secnrity . i 

implementation in; the CIDR and' 1 

assist in its alignment to file IS P'ljtn 

► Study testing strategy and develop 

system test cases 1 :, 

► Assist in user acceptance testing of, ‘ 

1 


o 

I 

ft 

i 

s ~ 

ou. 

J ^ - 

1 — 

Testing :Tdam Member 1' 

i. - 


► Domain Architects (HVAC, Civil, Fire, 

► Business Continuity 

! 

► resting 




3 ! 
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TOTAL cost of services 



breakdown ok remuneration 










































































breakdown of reimbursable expenses 
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MISCELLANEOUS EXPENSES 



Deliverables /Timelines and Payment Schedule 
































































DUTIES OF THE "EMPLOYER" 


=—— _ ittee : This project will entail interactions 

inunity of stakeholders and also a challenging project delivei-v 
schedule. The consultant would request dial a Project Coordination team be 
appointed by UIDAI which could facilitate quick turnaround of key decisions and in 
organization of stakeholder consultations The UIDAI management along with the 
PMU will provide the necessary Project Management and Review for the consulting 


Review and approval of deliverables : Given the challenging timelines, the consultant 
would request thal the timelines and procedures for review and approval of 
deliverables be frozen during the project inception phase. The consultant would seek 
UIDAI’s support in timely closure of reviews and approvals. 


es.Tlie consultant 
o please provide for the following in the Project 


a. Air conditioned workspace for all members 

b. Meeting room facilities 

c. Audio conferencing facilities 

d. High speed internet connection 

e. Facility for document storage 

f. 5 desktops 


g. Access to office automation and printers and photocopiers 

4 SgBiniU'P °f« Project Deliverables Submission Sire: To enable easier collaboration 
UIDAI may create an electronic repository/facility where the project deliverables can 
be submitted. 

5 Pr ocurement of licen se s : At present the Consultant does not envisage usage of any 

proprietary tools for preparation of project deliverables. Hence the same has not been 
budgeted for. However, should a requirement for usage of any such tools arises the 
consultant would request UIDAI to procure (be licenses for these tools Further 
licenses or any software tools/hardware required for testing the application and 
infrastructure w.U have to be provided by UIDAI authority. In the context of user 
acceptance test of the application a counterpart team from UIDAI will have to be 
provisioned to undertake the acceptance testing which shall be guided assisted and 
m0,li£0red b * the consul,ant. 
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Dotetosunry 4,2010 

Ptace East Laming, Mkhigm, USA 
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Individual Experts 
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